All Posts

ITWhisperer · ‎08-30-2023

You could try replacing every special character with a backslash followed by that character. In the following example, the token used in the title is set when the field is clicked. The token value i...

You could try replacing every special character with a backslash followed by that character. In the following example, the token used in the title is set when the field is clicked. The token value is the contents of the second multi-value in the field, which has been hidden using CSS. (I tried using the replace in the token evaluation directly but it only seems to work on a field not a string.) <panel depends="$alwayshide$"> <html> <style> #escaped table tbody td div.multivalue-subcell[data-mv-index="1"] { display: none; } </style> </html> </panel> <panel id="escaped"> <table> <title>$escaped$</title> <search> <query>| makeresults | fields - _time | eval param="!@#$%^&*(){}|\";:<>/\\[]" | eval param=mvappend(param,replace(param,"([!@#$%^&*\{\}\|\";:<>\/\\\[\]])","\\\\\1"))</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">cell</option> <option name="refresh.display">progressbar</option> <drilldown> <eval token="escaped">mvindex($click.value$,1)</eval> </drilldown> </table> </panel>

jamaluddin-k · ‎08-30-2023

Hi, I have a simple TCP syslog server in the same network where I have setup my Splunk Enterprise platform 9.10. I am trying to forward the data polled into Splunk Enterprise by Add-On apps to the ...

Hi, I have a simple TCP syslog server in the same network where I have setup my Splunk Enterprise platform 9.10. I am trying to forward the data polled into Splunk Enterprise by Add-On apps to the TCP Syslog Server. But even after configuring it from settings> Forwarding and Receiving, I am getting error like connection Timed out. Can anyone suggest what is being missed or needs to be looked into here. Thank you

Thulasinathan_M · ‎08-30-2023

Hi @gcusello, It can be anywhere in the text.

man03359 · ‎08-30-2023

Here is the attachment of the output. Hope this helps.

man03359 · ‎08-30-2023

I am attaching the output and the entire search query - The count for source (src=retailautonomyfileage) is coming as 18 instead of 6 only because it is counting all the 3 Fnames at once. This ...

I am attaching the output and the entire search query - The count for source (src=retailautonomyfileage) is coming as 18 instead of 6 only because it is counting all the 3 Fnames at once. This can come in 3 separate counts for 3 Fnames. Search query- index="idx-stores-misc" source="C:\\TJXLogs\\Verify\\SQLLogs\\*" sourcetype="Store:SQLLogs:json" host=stp* (host="*.stp.local" OR host="*.tjxcorp.net") NOT host="stp-675*" | rex field=host "^(?<Device>[^\.]+)\.(?<Domain>.*)$" | rex field=source "SQLLogs.(?<src>\D+)_" | rex field=message "job.(?<message>\w+)." | lookup Stores_Inventory Device OUTPUT DeviceType Store Chain StoreNum | where DeviceType="SQL" AND NOT src="sqlserveruptime" AND NOT src="ordertracking" | eval status=if(((src="DB_Rebuild_Indexes_UpdateStats_MDM" OR src="DB_Stop_IndexRebuild_Jobs") AND (JobExecTime>39600 OR message="failed")) OR (src="RetailAutonomyDataSync" AND (JobExecTime>21600 OR message="failed")) OR (src="RetailAutonomyPromotionsDataSync" AND (JobExecTime>4000 OR message="failed")) OR (src="retailautonomyfileage" AND (((Fname="mdmdat" OR Fname="omsdat") AND Age>240) OR (Fname="promodat" AND Age>120))) OR (src="retaillineitemdup" AND Count>0) OR (src="esbmessagecount" AND MsgCount>5),"Down","Up") | stats count count(eval(status="Down")) AS Down latest(_time) as _time BY Device Store src host Chain StoreNum Domain | eval Status=if(Down=count AND count>0, "0", "1")

gcusello · ‎08-30-2023

Hi @man03359 , ok, it can have one of the three values or there are more values for the same event? Could you share a sample of your logs, highlighting the values? Ciao. Giuseppe

man03359 · ‎08-30-2023

Is Fname is a multivalue field having 3 values : mdmdat, omsdat and promodat. The problem is in this line - (src="retailautonomyfileage" AND (((Fname="mdmdat" OR Fname="omsdat") AND Age>240) OR (Fn...

Is Fname is a multivalue field having 3 values : mdmdat, omsdat and promodat. The problem is in this line - (src="retailautonomyfileage" AND (((Fname="mdmdat" OR Fname="omsdat") AND Age>240) OR (Fname="promodat" AND Age>120))) It is giving the count of src incorrect, it is reading all the 3 fnames as one. I am trying to break them in 3 conditions using Fname so that it counts the individual Fname at once. eg. (src="retailautonomyfileage" AND Fname="mdmdat" AND Age>240) lly for other 2 Fnames. Hope I am able to explain.

Gong1027 · ‎08-30-2023

Dear Splunk experts, Just want to ask about the general upside/downside of creating a large number of indexes. Thinking to create a Splunk index per application/service so we may end up with 3K to...

Dear Splunk experts, Just want to ask about the general upside/downside of creating a large number of indexes. Thinking to create a Splunk index per application/service so we may end up with 3K to 5K indexes But this would allow us to target <<inputs.conf>> based on application/service Just not sure of the downside of that many indexes... Appreciate your advice.

gcusello · ‎08-30-2023

Hi @Thulasinathan_M, if you always have a special char in the beginning of the token, you could add a backslash "\" as prefix to the token. Ciao. Giuseppe

Thulasinathan_M · ‎08-30-2023

Hi Splunk Experts, I've a table and based on a click, I'm holding the value of field in token and using it in a different panel with search command. If there are any special characters the search is...

Hi Splunk Experts, I've a table and based on a click, I'm holding the value of field in token and using it in a different panel with search command. If there are any special characters the search is getting failed. I've tried replacing it with '*', but that gives me unexpected results. So I'm thinking of escaping all possible special characters in the token value. Please advice!! Ex: !@#$%^&*(){}|";:<>/\[] I want them as below: \!\@\#\$\%\^\&\*\{\}\|\"\;\:\<\>\/\\\[\]

gcusello · ‎08-30-2023

Hi @man03359 , let me understand: the Fname field is a single value or a multivalue field, before the stats command? If it's a multivalue, you have to separate them using "mvexpand" command (https:...

Hi @man03359 , let me understand: the Fname field is a single value or a multivalue field, before the stats command? If it's a multivalue, you have to separate them using "mvexpand" command (https://docs.splunk.com/Documentation/SCS/current/SearchReference/MvexpandCommandOverview#:~:text=The%20mvexpand%20command%20creates%20individual,productId%20which%20has%20multiple%20values.). If it's a single value field there isn't no reasong to have the described behaviour. Anyway, (I cannot test but it should work), if it's a single value field, you could try to use separated evals: | eval status=if(((src="DB_Rebuild_Indexes_UpdateStats_MDM" OR src="DB_Stop_IndexRebuild_Jobs") AND (JobExecTime>39600 OR message="failed")),"Down",""), (src="RetailAutonomyDataSync" AND (JobExecTime>21600 OR message="failed")),"Down",""), (src="RetailAutonomyPromotionsDataSync" AND (JobExecTime>4000 OR message="failed")),"Down",""), (src="retailautonomyfileage" AND (((Fname="mdmdat" OR Fname="omsdat") AND Age>240) OR (Fname="promodat" AND Age>120))) OR (src="retaillineitemdup" AND Count>0) OR (src="esbmessagecount" AND MsgCount>5),"Down","") | stats count count(eval(status="Down")) AS Down latest(_time) as _time BY Device Store src host Chain StoreNum Domain Ciao. Giuseppe

akarivaratharaj · ‎08-30-2023

Thankyou! The code with case statement is working for me. To consider the value '2' also, I can use value <= 02

diag · ‎08-30-2023

It really helped me understand the SPL.

kristen · ‎08-30-2023

I want to offload some logs into MinIO using smartstore to reduce volume consumption in license, but I cannot find reference if smartstore will still count against the license volume

man03359 · ‎08-30-2023

Hi All, I am trying to build a search query for an alert and below is the condition- | eval status=if(((src="DB_Rebuild_Indexes_UpdateStats_MDM" OR src="DB_Stop_IndexRebuild_Jobs") AND (JobExecTi...

Hi All, I am trying to build a search query for an alert and below is the condition- | eval status=if(((src="DB_Rebuild_Indexes_UpdateStats_MDM" OR src="DB_Stop_IndexRebuild_Jobs") AND (JobExecTime>39600 OR message="failed")) OR (src="RetailAutonomyDataSync" AND (JobExecTime>21600 OR message="failed")) OR (src="RetailAutonomyPromotionsDataSync" AND (JobExecTime>4000 OR message="failed")) OR (src="retailautonomyfileage" AND (((Fname="mdmdat" OR Fname="omsdat") AND Age>240) OR (Fname="promodat" AND Age>120))) OR (src="retaillineitemdup" AND Count>0) OR (src="esbmessagecount" AND MsgCount>5),"Down","Up") | stats count count(eval(status="Down")) AS Down latest(_time) as _time BY Device Store src host Chain StoreNum Domain But I am facing difficulty at line 4- OR (src="retailautonomyfileage" AND (((Fname="mdmdat" OR Fname="omsdat") AND Age>240) OR (Fname="promodat" AND Age>120)))It is reading all 3 filenames as one (Fname). It is taking all 3 file names (Fname=mdmdat,omsdat,promodat) as one and hence I am getting the incorrect count for the src=retailautonomyfileage I am trying to break the condition of line no 4 into 3 parts within the eval condition itself. Thanks in advance.

ITWhisperer · ‎08-30-2023

By the way, you conditions do not take account of the value being 2 <format type="color"> <colorPalette type="expression">case(isnull(value),"#c1fa9b", value < 02, "#c1fa9b", va...

By the way, you conditions do not take account of the value being 2 <format type="color"> <colorPalette type="expression">case(isnull(value),"#c1fa9b", value < 02, "#c1fa9b", value > 02, "#ff9c9c")</colorPalette> </format>

gcusello · ‎08-30-2023

Hi @Kingsly007, Anyway, it's still not clear what you mean with "Dynamic"? if you have comma divided values, the number of them isn't relevant. Could you share a sample of your logs? Ciao. Giuse...

Hi @Kingsly007, Anyway, it's still not clear what you mean with "Dynamic"? if you have comma divided values, the number of them isn't relevant. Could you share a sample of your logs? Ciao. Giuseppe

gcusello · ‎08-30-2023

Hi @Mostafa3081, let me understand: you want to extract a part of a field in a summary index, is it correct? If this is your requirement and if you can, the easiest way is to save the field to extr...

Hi @Mostafa3081, let me understand: you want to extract a part of a field in a summary index, is it correct? If this is your requirement and if you can, the easiest way is to save the field to extract in the summary generating search. Anyway, you can extract the part of the "text" field using a rex command: | rex field=text "href\=\\\"(?<url>[^ ]*)" that you can test at https://regex101.com/r/6jptux/1 Ciao. Giuseppe

Mostafa3081 · ‎08-30-2023

I have an event log that looks like this search_name=x, search_now=3.000, info_min_time=1692741600.000, info_max_time=1692828000.000, info_search_time=1692847620.636, app=Digital, text="<a hre...

I have an event log that looks like this search_name=x, search_now=3.000, info_min_time=1692741600.000, info_max_time=1692828000.000, info_search_time=1692847620.636, app=Digital, text="<a href=\"https://support.vodafone.co.uk/1627646512 \" target=\"_blank\"> ...etc ", info_log=l use the command ... | table text to extract the 'text' field, you get the expected result <a href=\"https://support.vodafone.co.uk/1627646512 \" target=\"_blank\"> ...etc However, when I attempt to extract the same 'text' field from the same event, but this time from a summary index, I get a different result <a href=\ and the whole value is presented in the event tap when i enable the verbose mode so the whole value is in the summary index but i can't show it. how to prevent splunk from truncating the result if it is in the summary index

akarivaratharaj · ‎08-30-2023

I have my table panel with the column field as Month-year and this is a dynamic fields populated from my panel query. One more column is a text field and it is a static field. (This does not need to ...

I have my table panel with the column field as Month-year and this is a dynamic fields populated from my panel query. One more column is a text field and it is a static field. (This does not need to be color coded.) I want to color code the cell values in all the dynamic field, based on the below condition if the cell value is less than 2 - the cell should be coded in green if the cell value is more than 2 - the cell should be coded in red. Other cells with text values - the cell should not be color coded. I tried to use multiple conditions with color palatte expression but that does not work <format type="color"> <colorPalette type="expression">if(isnull(value), "#c1fa9b", if(value<02, "#c1fa9b", "#ff9c9c"), if(value>02, "#ff9c9c", "#c1fa9b"))</colorPalette> </format> I did the two conditions similar, just to filter the fields with text values. So that all the numeric fields with values less than 2 will be displayed as green and the greater than 2 will be displayed as red. I am aware of writing JS scripts for this but would like to make this with SimpleXML. Could anyone please help me on this?

All Posts

All Posts

Re: How to escape all possible special characters

How to Forward Data from Splunk Enterprise to TCP Syslog Server?

Re: How to escape all possible special characters

Re: Break the eval condition in 3 line

Re: Break the eval condition in 3 line

Re: Break the eval condition in 3 line

Re: Break the eval condition in 3 line

Should I create a large number of indexes?

Re: How to escape all possible special characters

How to escape all possible special characters

Re: Break the eval condition in 3 line

Re: How to add multiple conditions and the respective color coding for all the fields?

Re: calculate the total number as Excel.

Does smartstore consume ingestion volume license

How to Break the eval condition in 3 line?

Re: How to add multiple conditions and the respective color coding for all the fields?

Re: How to split comma separated values in single event and make each value as one row of table with individual values

Re: splunk feild extraction from a summary index

How to do splunk field extraction from a summary index?

How to add multiple conditions and the respective color coding for all the fields?

All Posts

Are you a member of the Splunk Community?

All Posts