Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About tb5821
tb5821
Communicator
Member since:
03-22-2012
01-09-2021
Community Statistics
| Posts | 144 |
| Solutions | 3 |
| Karma Given | 4 |
| Karma Received | 10 |
| Member Since | 03-22-2012 |
Activity Feed
- Posted Monitoring Windows - app/dashboards? on All Apps and Add-ons. 01-09-2021 10:26 AM
- Posted Re: Listing out dates and appending to search?? on Splunk Search. 09-29-2020 10:27 AM
- Posted Listing out dates and appending to search?? on Splunk Search. 09-29-2020 09:16 AM
- Posted db Connect Unable to write records on All Apps and Add-ons. 09-24-2020 11:44 AM
- Posted Re: Transaction to Streamstats on Splunk Search. 09-05-2020 09:09 AM
- Posted Re: Transaction to Streamstats on Splunk Search. 09-04-2020 09:34 AM
- Posted New 'splunk answers' bad on #Random. 09-02-2020 09:26 AM
- Posted Transaction to Streamstats on Splunk Search. 09-01-2020 07:45 AM
- Posted Website Monitoring Trace? on All Apps and Add-ons. 06-26-2020 11:27 AM
- Posted Visualize Single value format on Dashboards & Visualizations. 06-19-2020 12:29 PM
- Got Karma for Re: How can I have one query for both a dashboard and an alert?. 06-05-2020 12:50 AM
- Got Karma for streamstats and delta. 06-05-2020 12:49 AM
- Got Karma for Re: Rexgex Non-capturing group - still capturing. 06-05-2020 12:49 AM
- Got Karma for Why do I get a 400 stanza error when using a join command in searches?. 06-05-2020 12:49 AM
- Karma Why is there a delay in applying field extraction updates? for phemmer. 06-05-2020 12:48 AM
- Karma Re: Move Splunk's VAR folder ($SPLUNK_HOME/var or /opt/splunk/var) for woodcock. 06-05-2020 12:47 AM
- Karma Re: Proper REX command for amit_saxena. 06-05-2020 12:46 AM
- Got Karma for Mutiple subsearches. 06-05-2020 12:46 AM
- Got Karma for Mutiple subsearches. 06-05-2020 12:46 AM
- Got Karma for Mutiple subsearches. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-25-2013
08:57 AM
Error in 'SearchParser': Missing a search command before '''.
...| 'resize(fs)'
... View more
07-25-2013
08:43 AM
1 Karma
Can I do it in search? I don't have access to anything but the search UI
... View more
07-25-2013
08:16 AM
I'm surprised splunk doesn't have an easier way to get a human readable format by passing it the field you want it to work its magic on al-la du -h
So here's my question, I have a field called fs which is file size but its in bytes. I want to convert that to the proper Kb,Mb,Gb format... whats the best way to do this?
... View more
07-18-2013
12:40 PM
Error in 'rex' command: Encountered the following error while compiling the regex '(?i)(?P : [0-9]+)$': Regex: unrecognized character after (?P
... View more
07-18-2013
12:12 PM
Not sure how to do that and ensure it still matches on ' : 949495'
... View more
07-18-2013
08:36 AM
Yes all of it is what I want, I need to make one more clarification is that when its present its ALWAYS at the END of the line. Its the last string. The rex above is pulling data out in the middle of the line as well which is not desired.
... View more
07-18-2013
06:55 AM
1 Karma
What would the proper REX command be to extract the following:
SPACE:SPACE then a numeric string
so ends up being ' : 949495'
... View more
07-09-2013
06:17 AM
I got it working here's the modified search:
index=myindex | rex "(?i)^[^[][(?P [^]]+)" | sourcetype=jobLogs [search index=myindex sourcetype=jobLogs "Job Failed" | rex "(?i)^[^[] [(?P [^]]+)" | fields jobNumber | dedup jobNumber] | transaction jobNumber
... View more
07-09-2013
06:09 AM
Here's my current search
index=myindex sourcetype=jobLogs [search index=myindex sourcetype=jobLogs "Job Failed" | rex "(?i)^[^[]*[(?P [^]]+)" | fields jobNumber | dedup jobNumber] | transaction jobNumber
... View more
07-09-2013
06:06 AM
I think I found the problem somewhere in the fact that I'm using rex to obtain the jobNubmer and its not using jobNumber=###### once the subsearch is evaluated.
... View more
07-09-2013
05:40 AM
The sub-search by itself produces the jobNumber's as expected but for some reason adding the outer search produces zero results.
... View more
07-08-2013
01:59 PM
That doesn't work I don't think you can have jobid = and then a bracket.
... View more
07-08-2013
01:34 PM
It won't let me do jobid=[
Error in 'search' command: Unable to parse the search: Comparator '=' has an invalid term on the right hand side.
... View more
07-08-2013
12:36 PM
I search: index=myindex source=jobs "Failed Job"
one of the fields that gets extracted is jobId but this obviously only gets me that one line with Failed Job not all the lines for that job.
... View more
07-08-2013
12:17 PM
I don't want to manually have to type the failed jobid I'd like to see it be dynamic off of the jobid's that were returned by looking for ones that have failed.
... View more
07-08-2013
11:54 AM
I only want the failed job events how do I achieve that with what linu1988 suggested?
... View more
07-08-2013
11:28 AM
1 Karma
I have a search that finds failed jobs from my logs. Each of those failed jobs has a job number. I'd like to then take those job numbers and get all the log lines that contain one of those job numbers. Whats the best way to do this?
... View more
- Tags:
- join
- sub-search
05-23-2013
02:21 PM
I find the field extractor hard to work with... when you go into extract fields if the data your looking to extract isn't part of the sample then you kinda have a hard time.
... View more
05-23-2013
12:42 PM
I'm trying to use this niffty regex generator using the perl option.
http://txt2re.com/index-java.php3?s=%3CTAG\b[^%3E]*%3E%28.*?%29%3C/TAG%3E&-24
I get the code from that page in perl format and then try to use it in splunk as REX:
... | rex
("$re1='(file)'; # Word 1
$re2='(:)'; # Any Single Character 1
$re3='(\\/)'; # Any Single Character 2
$re4='((?:\\/[\\w\\.\\-]+)+)'; # Unix Path 1
$re5='( )'; # White Space 1
$re6='(does)'; # Word 2
$re7='( )'; # White Space 2
$re8='(not)'; # Word 3
$re9='( )'; # White Space 3
$re10='(exist)'; # Word 4
$re=$re1.$re2.$re3.$re4.$re5.$re6.$re7.$re8.$re9.$re10;
if ($txt =~ m/$re/is)
{
$word1=$1;
$c1=$2;
$c2=$3;
$unixpath1=$4;
$ws1=$5;
$word2=$6;
$ws2=$7;
$word3=$8;
$ws3=$9;
$word4=$10;
}")
here's the error I get:
Error in 'rex' command: The regex '$re1='(file)'; # Word 1 $re2='(:)'; # Any Single Character 1 $re3='(\/)'; # Any Single Character 2 $re4='((?:\/[\w\.\-]+)+)'; # Unix Path 1 $re5='( )'; # White Space 1 $re6='(does)'; # Word 2 $re7='( )'; # White Space 2 $re8='(not)'; # Word 3 $re9='( )'; # White Space 3 $re10='(exist)'; # Word 4 $re=$re1.$re2.$re3.$re4.$re5.$re6.$re7.$re8.$re9.$re10; if ($txt =~ m/$re/is) { $word1=$1; $c1=$2; $c2=$3; $unixpath1=$4; $ws1=$5; $word2=$6; $ws2=$7; $word3=$8; $ws3=$9; $word4=$10; }' does not extract anything. It should specify at least one named group. Format: (?<name>...).
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-09-2021
06:32 PM
|
Karma from
