About cpetterborg

cpetterborg · ‎11-04-2019

There is no real difference, you will get the same result from both of them.

cpetterborg · ‎07-03-2019

Can you fix your information above by using the 101010 button to keep Answers from interpreting things like <fieldname> improperly? That will make I much easier to answer you question.

cpetterborg · ‎07-02-2019

It would actually be: | makeresults count=1 | eval val=4 | eval ptn="(?<dig>\d)" | map search="| rex field=val $ptn$" Except that the search results don't go into the map command for val in that way, and you can't send the val value into the search like this: | makeresults count=1 | eval val=4 | eval ptn="(?<dig>\d)" | map search="| rex field=$val$ $ptn$" because the val value isn't a field name. So you are stuck between a rock and a hard place. The rex command requires a quoted string for the regex that it will use, not a field. I don't know of a way that you can do what you are wanting to do.

cpetterborg · ‎06-30-2019

Does something like this do what you want?: <your search> | timechart values(run) as x1, values(wait) as x2 span=1s | filldown x1, x2

cpetterborg · ‎06-20-2019

Universal forwarders DO NOT parse the data, so there can be no transforms on the UF. As to the second part of your question, I don't think that you can, particularly on the UF. If you want to do such a think on the indexer, then that is where you should do it (or on an intermediate heavy forwarder). The UF's are not particularly helpful in looking at the data and performing any sorts of manipulation (except in the Windows Event Logs where they have made a particular use case for doing some parsing of that data).

cpetterborg · ‎05-27-2019

You can always use the rex command to create/modify a field that is always extracted. For example: | makeresults | eval IP="10.0.0.1:9997" | rex field=IP "(?<myIP>[\d.]+)" will result in myIP containing just the IP, and not the port from the IP field. For future reference, it is always best to give some example data with your question so that it is easier to help answer you particular problem.

cpetterborg · ‎02-07-2019

I answered this question the other day for someone. I'm going t assume you want to do this at search time, not index time. The other assumption I'm going to make is that these values are all in the same event. And one final assumption is that the event has the same order each time for the parameters that you want to use. You will want to use the rex command with mode=sed so that it will actually do the substitution inside the value of the Message field. Something like this can do what you want (and this is using data exactly as you have it above. If it is different, adjust): | makeresults | eval data="PARAM1: Thing1 PARAM2: Thing2 PARAM3: Thing3 MESSAGE: Refer to P1 and P2 in conjunction with P3 and escalate as need be." | rex mode=sed field=data "s/(PARAM1: )(\w+)([\s\S]*PARAM2: )(\w+)([\s\S]*PARAM3: )(\w+)([\s\S]*MESSAGE: )(.*)P1(.*)P2/\1\2\3\4\5\6\7\8\2\9\4/" | rex mode=sed field=data "s/(PARAM3: )(\w+)([\s\S]*MESSAGE: )(.*)P3/\1\2\3\4\2/" The rex command is the only real necessary part. The rest is just setting up the data. This is a general case solution given the data that you provided above.

cpetterborg · ‎01-31-2019

You still need the examples to have the additional characters, the way they would appear IRL, or at least the = and " characters, because the rex I presented above works on this data.

cpetterborg · ‎01-30-2019

Unless the double quotes inside the field are escaped (for example with a backslash) you are pretty much screwed because there doesn't seem to be enough regularity to the string to make extracting it properly an option. If you give an exact example (doesn't have to contain real data, just valid data with all the possibilities, so clean it up for public consumption), it might be possible to help you on this.

cpetterborg · ‎01-30-2019

As long as there is something like ;wordchars= after the quoted data you want to extract, the following will probably work for you: | makeresults | eval data="reason=\"a\\\"b\"c\";appName=.... reason=\"x;yz\";ERServer=... reason=\"df,g\",ClientBob=..." | makemv delim=" " data | rex field=data "reason=\"(?<reason>.*?)\"[;,]\w+="

cpetterborg · ‎01-29-2019

Here is a run anywhere search that shows the rex command that will pick out the field as you have provided the data for in your question: | makeresults | eval data="reason=\"abc\";appName=.... reason=\"xyz\";ERServer=... reason=\"dfg\",ClientBob=..." | makemv delim=" " data | rex field=data "reason=\"(?<reason>[^\"]*)" I'm not sure if this meets your requirements, but it can be run in any Splunk search bar and produce the results you have requested. The last line is the only one that is really doing any of the work for that purpose. The other lines are only setting up the data that simulates the events as portrayed above.

cpetterborg · ‎01-28-2019

Also make sure you are doing the search in the same app and the permissions on the field extraction are set for the app, and just not private.

cpetterborg · ‎01-26-2019

If you have an index cluster, you don't want to use an indexer was a search head. Indexers in a cluster should only have that one role, and no others.

cpetterborg · ‎01-22-2019

Search time regex like this (I would assume you are doing it with a rex command) can't extract the field name in this manner. You won't get any fields because you aren't using a named capture group, only unnamed capture groups. If you want this to work, it would have to be done at index time. If you can't do it at index time you need to extract the fields with named capture groups, which is probably going to be a PITA to do with events that are not equivalent to each other. You may have to do something like: ... | rex "\<code\> (?<Code>\d+)" | rex "<\Type\> (?<type>[^\<]+)\s" | rex ...

cpetterborg · ‎01-07-2019

If one of these answers has worked for you, please accept the answer, so that future viewers of this question can know that it has been answered for you, and which one worked for you. Thanks!

cpetterborg · ‎01-04-2019

Probably something like: Printed\D+0*(\d+) should work. \D+ is all non-digits, followed by zero or more 0 's, then it puts the other digits is the capture group.

cpetterborg · ‎12-21-2018

Be careful with the | rename COMMENT line above, as it can result in an error when you run the search (It does on 7.1.0, and probably others).

cpetterborg · ‎12-21-2018

What exactly do you mean by lower_bound_date_of_week and upper_bound_date_of_week ?

cpetterborg · ‎12-21-2018

What do you get from just: source="/var/log/lag/stats.txt" d=* | eval namespace=trim(replace(namespace,"sample-text.","")) | eval Processed_time=_time | stats count by namespace Are you getting all the namespace values you expect?

cpetterborg · ‎12-21-2018

Since our data is not your data, what do you have for the results with the time wrap that is not what you want, but right in the result without the timewrap ? Perhaps a screenshot of the latter?

cpetterborg · ‎12-21-2018

As Rich says, "ignoring real time". You don't want to do a transaction command in a real-time search, it will just mess things up. Hopefully you are meaning that you want to just get the results at search time, not index time when you say "real time."

cpetterborg · ‎12-20-2018

You can change a parameter in the limits.conf file to get rid of this error, but you will have to make thew value high enough to keep it from giving you the error. Don't make it too high, but enough to fix your problem. The value, I believe, is max_infocsv_message and the default is something like 20. In your case I'd set it to 50, but you may have to experiment. Look at the limits.conf documentation to make sure you are doing it all correctly: https://docs.splunk.com/Documentation/Splunk/7.2.1/Admin/Limitsconf

cpetterborg · ‎11-08-2018

Also, if the length of the message is too big, that can cause it to be rejected for an SMS message. Has the length of the message increased?

cpetterborg · ‎11-07-2018

I've moved the comment to an answer, so you can accept the answer if it has given you the answer that you need. Thanks!

cpetterborg · ‎11-06-2018

Like this (use this exact search to see if the values are what you want)?: | makeresults | eval data="[INFO ] [2018-11-07 01:06:16 +0000] [69919359600740] connection_counter {22=>2, 29=>3, 16=>5, 21=>3, 14=>3}" | rex field=data max_match=0 "(?<id>\d+)=>(?<value>\d+)"

Posts	750
Solutions	109
Karma Given	133
Karma Received	249
Member Since	‎03-27-2012

Online Status	Offline
Date Last Visited	‎09-26-2025 06:35 AM

Cluster members going into AutomaticDetention for ...

Event breaking not working on Tomcat Catalina data

Why is a standalone search head getting duplicate ...

How do I debug perfmon:memory missing on a windows...

After migrating from search head pooling to search...

Orphaned Scheduled Search doesn't work

When will the Box App for Splunk be updated to wor...

Can't delete a saved search - Do I have to try it ...

Higher value of squash_threshold no longer making ...

Splunk DB Connect 2: Metadata configuration proble...

Re: What is the difference in name capturing grou...

Re: Regex in props.conf doesn't work

Re: Regex from variable

Re: How to create chart from 2 different fields

Re: How to configure source_type to regex value?

Re: How to edit regex for existing fields

Re: How do I replace text within a field with text...

Re: Rex to extract text that ends with either one ...

Re: Rex to extract text that ends with either one ...

Re: Rex to extract text that ends with either one ...

Re: Rex to extract text that ends with either one ...

Re: Why would a query using a predefined field wor...

Re: How to configure Search Head in one of the Ind...

Re: Why isn't this field transform working?

Re: Use rex to remove leading zeros

Re: Use rex to remove leading zeros

Re: Can you help me find the time between events?

Re: How do I get the lower and upper bound of a ti...

Re: Should I use Lookup or mvexpand in the followi...

Re: How come the timewrap command is displaying to...

Re: How can I merge events based on Start and End ...

Re: Why am I getting the following error while doi...

Re: Why are Splunk alerts not sending to cell phon...

Re: How do you extract multiple key value pairs wi...

Re: How do you extract multiple key value pairs wi...

Join the Conversation