About cpetterborg

cpetterborg · ‎11-04-2018

There are several things wrong with the SEDCMD. Try: SEDCMD-ranjit=s/^(\w+\s\w+\s\w+\s)(\w+)/\1XXXXXXXX/g That should do what you want.

cpetterborg · ‎10-30-2018

The first two lines from the above search are just setting up the data that YOU provided in your question. The last two lines are using THAT data to produce the results that you want. You have to ADAPT the search to YOUR instance, it is not a complete solution, but you only provided a fraction of what was needed for a complete solution.

cpetterborg · ‎10-30-2018

The following "run-anywhere" search shows what you can do with rex, and event stats: | makeresults | eval data="count: 0 0 0 0 0 0 0 0 0 0 3890 24759 30388 3468 8 5079 6680 4410 6167 838 739 178 1 16 1]" | rex field=data max_match=0 " (?<val>\d+)" | eventstats sum(val) as total This should give you what you want if your data is as your example shows.

cpetterborg · ‎10-24-2018

Something like the following should work for you (this is a run-anywhere search that you can copy/paste into your Splunk search bar and it will run): | makeresults | eval data="{\"timestamp\": \"2018-10-24T08:46:02.205664\", \"type\": \"sw\", \"serial\": {\"Switchah3nv\": \"000123456789\"}, \"system_time\": \"Wed Oct 24 08:46:04 CEST 2018\",}" | rex field=data "\"serial\": \{\"(?<hostname>[^\"]*)\": \"(?<serial_number>[^\"]*)\"" | table hostname, serial_number The rex line is probably the only line (with the exception of the table line) that you really need to worry about, but it shows what you can do with the search to get the data that you want. The field=data part of the rex line will probably have to be changed to match your data.

cpetterborg · ‎10-22-2018

Please provide some sample data of what is no longer working. Thanks!

cpetterborg · ‎10-18-2018

cpetterborg · ‎09-21-2018

You have not said whether or not you need to get this data at search time or index time, so I'm going to assume search time (since that is Splunk Best Practice. Here is a run anywhere search that shows how you can do the field extraction. I leave it up to you to decide how you will implement the regular expression, whether it be in an automatic field extraction, or done as an inline search: | makeresults | eval data="2139,A-1112,74,01:11:71:E1:A1:C1,store,store@store.net,Nitro,Enroll,nitrofire Enroll,,Windows ,Redblue - B111.B4321,,C,1.1.3213,5/4/2018 7:23,Compliant,Enrolled,,MDM,9/20/2018 4:43,,No ,N/A,United States,Yes,00000000A6C344A354543534535345CEBD4A928D,000-88,,No,3/9/2018 17:38,9/20/2018 4:30" | rex field=data "MDM,(?<datefield>[^,]*)," The rex portion is the only part that you would really need to be concerned with from the above search, as it gives you the regular expression that you need.

cpetterborg · ‎09-18-2018

Can you provide some sample (obfuscated) data for each type of log? If you don't mind actually changing the events, it can be done in props.conf to make them look the same, but it will take seeing actual data to provide you with that answer.

cpetterborg · ‎09-17-2018

Is your problem that you don't know how to search only in the latest version of the files that you have ingested? Or are you having issues specifying the source properly because they are always different? It is possible to get change the source for the file to eliminate the parts that are different with each new filename, but I don't know if that is one of your issues, but you do state in your posting "and therefore don't know how to access the file in Splunk." Some additional clarification will certainly help. 🙂

cpetterborg · ‎09-12-2018

So do you want the js and cjs values from the sample field stored in a separate field (like one named ext ) at search time?

cpetterborg · ‎08-28-2018

Here is one way to get the pie chart to work. It may not be the best, but it will at least get you started. It is a run-anywhere search that you can just paste into the search bar and it will show you the results of the data that you have provided: | makeresults | eval data="{\"Domain\":\"DotComMobile\",\"Metrics\":\"city\",\"Brooklyn\":782,\"Bronx\":450,\"New York\":411,\"Philadelphia\":287,\"Chicago\":254,\"Washington\":210,\"Silver Spring\":176,\"Houston\":148,\"Los Angeles\":140,\"Boston\":133}" | spath input=data | fields - data, Domain, _time, Metrics | fieldsummary | fields field max

cpetterborg · ‎08-23-2018

I've converted the comment to an answer, so it can now be accepted, @shankarananth.

cpetterborg · ‎08-22-2018

Is the field URGP_0 a field that is extracted already? I don't see that you are creating it anywhere in your data, and it isn't a KV pair, so it looks like your search is looking for a field called URGP_0 . It also appears that your data is not complete. You may want to update the question to use the 101010 button to mark the text instead of the " button so that is does it as code instead of a quote.

cpetterborg · ‎08-15-2018

You can do it all in props.conf with the following as an example: [es_prd_api] SEDCMD-anonauth = s/Authorization=.*/Authorization=########/ SEDCMD-anonrefer = s/Referer=.*/Referer=########/ SEDCMD-anonencs = s/Enc-Session=.*/Enc-Session=########/

cpetterborg · ‎08-12-2018

Not sure why you are using %e instead of %d, nor why you aren't using %Z. I doubt that is what is causing your problem, however. Do you have someplace in your props.conf files a directive to use the index time as the timestamp, which could be superseding the above configuration? Look for that sourcetype or other indication of a configuration clause that could be overriding things. You probably should look at using btool. Something like: splunk btool props list --debug Then look at the output for the sourcetype and see if it is using the configuration you expect it to be using.

cpetterborg · ‎08-06-2018

Search-time? Index-time? Are all the events similar? Is that the whole event? If you just want a search-time rex way with the example data being the whole event: ... | rex "\[(?P<ms>\d+)ms\]" If it isn't the entire event, then use the field=yourfieldname option to the rex command.

cpetterborg · ‎08-05-2018

So what was the exact thing that didn't work in Dal's approach?

cpetterborg · ‎08-02-2018

I have not done that, so I don't know, but I should think that it is possible, given that most things are available through the API's. I have been told that the SDK is not as robust as the REST API, but I don't have first hand knowledge of that.

cpetterborg · ‎08-02-2018

Does the run-anywhere search above work on your Splunk? If it doesn't, then you have something seriously odd going on. If it does, but the single line search above doesn't work, then your data doesn't look the way you have said, because each of the options that you have been given by the various contributors here should work. Look at your data carefully and figure out why it is not the same as what you have posted here.

cpetterborg · ‎08-01-2018

This looks mostly fine. I'd put the last - in the square brackets at the front of the list, though: ... | rex "\"ContactId\":\"(?<ContactId>[-a-zA-Z0-9]*)\"" Otherwise it seems fine. Do you also need to specify the field in this case? Sometimes that is needed to get it to work properly. There is just barely enough information about your problem to go on. This is a run-anywhere search that shows that it should work: | makeresults | eval data="\"ContactId\":\"12345\"" | rex field=data "\"ContactId\":\"(?<ContactId>[-a-zA-Z0-9]*)\""

cpetterborg · ‎07-23-2018

At the very least your FORMAT has a problem. You only have one capture group in the text that I can see (though you may have put in more, and it has been formatted out because you didn't use the code formatting). It should be: FORMAT = AcctID=XXXXXXXX$1 I would also use the suggestion from @MuS of the SEDCMD in props.conf : SEDCMD-acctid = s/AcctID=\d{8}/AcctID=XXXXXXXX/g

cpetterborg · ‎07-18-2018

Look carefully through the output of the following commands (assuming Linux, and you have splunk in your path, etc.): splunk list monitor | less splunk btool inputs list --debug | less splunk btool inputs list --debug | less

cpetterborg · ‎07-18-2018

A simple and fast (efficient) way is with rex : ... | rex mode=sed field=AUDIT_CREATED_TS "s/\s.*//" It doesn't have to do any time calculations, just some simple string substitution.

cpetterborg · ‎07-17-2018

Everything looks good in the config. Have you looked to see if there is anything overriding that configuration that might be causing the date parsing problem? Use btool to see what Splunk is actually seeing as the configs: splunk btool props list --debug | less Then search for apm_json and see if the configs for that sourcetype match the above configs.

cpetterborg · ‎07-12-2018

If the data is going into Splunk correctly, then you should have the time in the variable _time as well as getting access to each of the fields named date_* for the year , month , day , hour , minute , second . You would not get the sub-second value automatically. The _time field can be output in any number of formats. So you should have that same data available to you without having to use a regex. If on the other hand you have need of that date specifically, then you can use a regex (like that provided by @kamiesh_veghela). Do you need that date broken up into different fields? If so, that is another regex, but can be done easily enough.

Posts	750
Solutions	109
Karma Given	133
Karma Received	249
Member Since	‎03-27-2012

Online Status	Offline
Date Last Visited	‎08-12-2025 02:41 PM

Cluster members going into AutomaticDetention for ...

Event breaking not working on Tomcat Catalina data

Why is a standalone search head getting duplicate ...

How do I debug perfmon:memory missing on a windows...

After migrating from search head pooling to search...

Orphaned Scheduled Search doesn't work

When will the Box App for Splunk be updated to wor...

Can't delete a saved search - Do I have to try it ...

Higher value of squash_threshold no longer making ...

Splunk DB Connect 2: Metadata configuration proble...

Re: SED command on props

Re: How do I sum up all values on one line to give...

Re: How do I sum up all values on one line to give...

Re: How do I rename unknown field name in a JSON f...

Re: After upgrading our Splunk version from 6.5 to...

Re: Can you help me with my multi-field field extr...

Re: Can you help me create a regex expression that...

Re: Can you help me delete the '\' character after...

Re: Inputcsv using a regex for the filename?

Re: Could you help me use rex to extract end value...

Re: JSON Field Extraction and Charting

Re: How can I extract values starting with a speci...

Re: How to use regex to extract just the ID inside...

Re: Help with Masking data

Re: timeformat are not getting extracted properly

Re: How to create a rex for search?

Re: How to get events that do not contain a partic...

Re: Transfer data to Splunk from database on diffe...

Re: rex extration with double quotes

Re: rex extration with double quotes

Re: data masking via transforms.conf and props.con...

Re: what could be the possible error of not gettin...

Re: How to remove hh:mm:ss from a date/time field ...

Re: Trouble extracting time in JSON

Re: interesting regex

Are you a member of the Splunk Community?