I have used the rex field=msgTxt but I keep getting errors. I'm sorry but I've worked on this for hours, and nothing seems to work. I'm still pretty new to Splunk and this is not in my skill-set. Maybe I should start over.. However, the results I'm looking for have slightly changed. The field or log that contains my results are located in msgTxt  and I would like to pull both  Latitude/Longitude values and the WarningMessages.  The field has Latitude and Longitude listed twice. Most of the time the first set will return 0's and the log will always be in this format. The log looks like this: StandardizedAddressService SUCCEEDED - FROM: {"Address1":"63 Somewhere NW ST","Address2":null,"City":"OKLAND CITY","County":null,"State":"OK","ZipCode":"99999-1111","Latitude":97.999,"Longitude":-97.999,"IsStandardized":false,"AddressStandardizationStatus":0,"AddressStandardizationType":0} RESULT: 1 | {"AddressDetails":[{"AssociatedName":"","HouseNumber":"63","Predirection":"NW","StreetName":"Somewhere","Suffix":"ST","Postdirection":"","SuiteName":"","SuiteRange":"","City":"OKLAND CITY","CityAbbreviation":"OKLAND CITY","State":"OK","ZipCode":"99999","Zip4":"1111","County":"Oklahoma","CountyFips":"40109","CoastalCounty":0,"Latitude":97.999,"Longitude":-97.999"Fulladdress1":"63 Somewhere NW ST","Fulladdress2":"","HighRiseDefault":false}],"WarningMessages":[],"ErrorMessages":[],"GeoErrorMessages":[],"Succeeded":true,"ErrorMessage":null} I'm hoping to see the following results: Latitude    Longitude   Latitude   Longitude    WarningMessages 99.2541     -25.214       99.254     -25.214        NULL 00.0000     -00.000        99.254     -21.218       NULL 00.0000     -00.000       00.000    -00.000        Error message with something The results for all of the phrases will be different and I will be searching through1000's of logs. If it's too much work to show both set of the Latitude/Longitude values, then the second set would work. Your help is greatly appreciated..  Thanks     ... View more

When I use | eval msgTxt= I get no results, but if I use | eval _raw it returns the requested data, but it repeats the same values.   index="cif" appEnvrnNam="Production" msgTxt="StandardizedAddressService SUCCEEDED*" | eval msgTxt="StandardizedAddressService SUCCEEDED - FROM: {\"StandardizedAddressService\":\"SUCCEEDED\",\"FROM\":{\"Address1\":\"123 NAANNA SAND RD\",\"Address2\":\"\",\"City\":\"GREEN\",\"County\":null,\"State\":\"WY\",\"ZipCode\":\"44444-9360\",\"Latitude\":null,\"Longitude\":null,\"IsStandardized\":false,\"AddressStandardizationStatus\":1,\"AddressStandardizationType\":1},\"RESULT\":1,\"AddressDetails\":[{\"AssociatedName\":\"\",\"HouseNumber\":\"123\",\"Predirection\":\"\",\"StreetName\":\"NAANNA SAND RD\",\"Suffix\":\"RD\",\"Postdirection\":\"\",\"SuiteName\":\"\",\"SuiteRange\":\"\",\"City\":\"GREEN\",\"CityAbbreviation\":\"GREEN\",\"State\":\"WY\",\"ZipCode\":\"44444\",\"Zip4\":\"9360\",\"County\":\"Warren\",\"CountyFips\":\"27\",\"CoastalCounty\":0,\"Latitude\":77.0999,\"Longitude\":-99.999,\"Fulladdress1\":\"123 NAANNA SAND RD\",\"Fulladdress2\":\"\",\"HighRiseDefault\":false}],\"WarningMessages\":[],\"ErrorMessages\":[],\"GeoErrorMessages\":[],\"Succeeded\":true,\"ErrorMessage\":null}" | rex "\"Latitude\"\s*:\s*(?<Latitude>-?\d+\.\d+)" | rex "\"Longitude\"\s*:\s*(?<Longitude>-?\d+\.\d+)" | rex "\"WarningMessages\"\s*:\s*\[\s*\"(?<WarningMessages>[^\"]*)" | table _time Latitude Longitude WarningMessages ... View more

I'm having issues getting this to work.  I posted my  search in a earlier post. I was told not to use the eval _raw line, I've tried removing it and I have used | eval msgTxt=" and it is still not working. What am I doing wrong? Please help. thanks ... View more

So if I'm not to use  | eval _raw="StandardizedAddres SUCCEEDED - FROM: {\"StandardizedAddres.................." Should I use  | eval msgTxt="StandardizedAddres SUCCEEDED - FROM: {\"StandardizedAddres\":\"SUCCEEDED\",\"FROM\":{\"Address1\":\"123 NAANNA SAND RD\",\"Address2\":\"\",\"City   And do I not include the /? ... View more

Scratch that first line.. Use this index="ifi" appEnvrnNam="ANY" msgTxt="Standardizess SUCCEEDED - FROM:*" ... View more

  index="ifi" appEnvrnNam="ANY" msgTxt="StandardizedAddress SUCCEEDED*" | eval _raw="Standardizedss SUCCEEDED - FROM: {\"Standardizedss \":\"SUCCEEDED\",\"FROM\":{\"Address1\":\"123 NAANNA SAND RD\",\"Address2\":\"\",\"City\":\"GREEN\",\"County\":null,\"State\":\"WY\",\"ZipCode\":\"44444-9360\",\"Latitude\":null,\"Longitude\":null,\"IsStandardized\":true,\"AddressStandardization\":1,\"AddressStandardizationType\":0},\"RESULT\":1,\"AddressDetails\":[{\"AssociatedName\":\"\",\"HouseNumber\":\"123\",\"Predirection\":\"\",\"StreetName\":\"NAANNA SAND RD\",\"Suffix\":\"RD\",\"Postdirection\":\"\",\"SuiteName\":\"\",\"SuiteRange\":\"\",\"City\":\"GREEN\",\"CityAbbreviation\":\"GREEN\",\"State\":\"WY\",\"ZipCode\":\"44444\",\"Zip4\":\"9360\",\"County\":\"Warren\",\"CountyFips\":\"27\",\"CoastalCounty\":0,\"Latitude\":77.0999,\"Longitude\":-99.999,\"Fulladdress1\":\"123 NAANNA SAND RD\",\"Fulladdress2\":\"\",\"HighRiseDefault\":false}],\"WarningMessages\":[\"This mail requires a number or Apartment number.\"],\"ErrorMessages\":[],\"GeoErrorMessages\":[],\"Succeeded\":true,\"ErrorMessage\":null}" | rex "StandardizedAddres SUCCEEDED - FROM: (?<event>.*)" | spath input=event | rename AddressDetails{}.* as *, WarningMessages{} as WarningMessages | table Latitude Longitude WarningMessages ... View more

Thank you it is working; however, it's repeating the same value. The search will be returning 1000's of logs each with a different value and some will not contain a warning message.       ... View more

I pleased to see your query is working; however, it's repeating the same values. Sorry, I did not explain that there will be 1000's of logs, each with a different value.     ... View more

Sorry to be a bother, but what if there is a special char like = involved. I can't add the equal sign into my search query.   | eval msxxxt="*Action=GexxxxdledxxxxReport Duration=853*" | rex "Duration (<?Duration>\d+)" | timechart span=1h avg(Duration) AS avg_response by msxxxt   Thanks again for your help ... View more

Thank you ... View more

Yes,  I attempted to use this: index="stuff" (msgTxt="Request recd." OR StatusCd="400" OR msgDtlTxt="Validation err*") | eval msgTxt=substr(msgTxt, 1, 100) | stats values(_time) as DateTime values(msgTxt) as Message values(StatusCd) as code BY userSesnId | eval DateTime=strftime(DateTime , "%m-%d-%Y %I:%M:%S %p") but its returning additional logs that I do not need or its only returning one specific log such as Request recd  I need it to gather all the logs within a single userSesnId and return only if it contains these logs (see highlighted below) and count as 1. msgTxt="Request recd." OR StatusCd="400" OR msgDtlTxt="Validation err*")     ... View more

Sorry.... I'm going to need to combine the policyid for both logs into one.  Both do not work..  Thanks again for your help.. Call out </ index=xxx appSubLvlNam="QAA" (msgTxt="Starting Controller=Full Action=GetFullReportAssessment data*" OR msgTxt="API=/api/full/reportAssessment/ CallStatus=Success*") | eval msgTxt "Starting Controller=Full Action=GetFullReportAssessment data={"policyId":"Q123456789","inceptionDate":"20241011","postDate":"1900-01-01T12:00:00"}" | rex "\"policyId\":\"(?<policyId>\w+)\"" | table policyId > Response </ index=xxx appSubLvlNam="QAA" (msgTxt="Starting Controller=Full Action=GetFullReportAssessment data*" OR msgTxt="API=/api/full/reportAssessment/ CallStatus=Success*") | eval msgTxt "API=/api/full/reportAssessment/ CallStatus=Success Controller=full Action=GetFullReportAssessment Duration=17 data={"policyId":"Q123456789","inceptionDate":"20241015","postDate":"1900-01-01T12:00:00"} " | rex "\"policyId\":\"(?<policyId>\w+)\"" | table policyId >   ... View more

</API=/api/full/reportAssessment/ CallStatus=Success Controller=Full Action=GetfullReportAssessment Duration=5 data={"policyId":"Q123456789","inceptionDate":"20241015","postDate":"1900-01-01T12:00:00"}>   </Starting Controller=Full Action=GetClueReportAssessment data={"policyId":"Q123456789","inceptionDate":"20241015","postDate":"1900-01-01T12:00:00"}/   ... View more

It returns a blank table.  ... View more

Unfortunately, it didn't pick up the policy ID.  It returns a blank table ... View more

This worked.. Thank you!! ... View more