Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About dhirendra761
dhirendra761
Contributor
Member since:
07-23-2018
05-14-2024
Community Statistics
| Posts | 184 |
| Solutions | 4 |
| Karma Given | 25 |
| Karma Received | 15 |
| Member Since | 07-23-2018 |
Activity Feed
- Posted Re: Indexed only Partial Contents of log file on Getting Data In. 03-05-2024 08:18 AM
- Posted Indexed only Partial Contents of log file on Getting Data In. 03-05-2024 07:51 AM
- Got Karma for Re: Can not communicate with task server, please check your settings.. 02-28-2024 09:09 AM
- Posted Re: How to set token value based on selection from multiselect input? on Splunk Search. 06-21-2023 06:37 AM
- Posted Re: set token value based on selection from multiselect input on Splunk Search. 06-15-2023 01:26 AM
- Posted Re: set token value based on selection from multiselect input on Splunk Search. 06-14-2023 10:54 AM
- Posted Re: set token value based on selection from multiselect input on Splunk Search. 06-14-2023 09:13 AM
- Posted How to set token value based on selection from multiselect input? on Splunk Search. 06-14-2023 08:39 AM
- Tagged How to set token value based on selection from multiselect input? on Splunk Search. 06-14-2023 08:39 AM
- Tagged How to get fields value which are not matched with other field value? on Splunk Search. 12-19-2022 05:23 PM
- Posted How to get fields value which are not matched with other field value? on Splunk Search. 12-19-2022 05:13 PM
- Posted Re: Field extraction from table values on Splunk Search. 12-02-2022 03:31 AM
- Posted Re: Field extraction from table values on Splunk Search. 12-02-2022 03:30 AM
- Karma Re: Field extraction from table values for yuanliu. 12-02-2022 02:59 AM
- Posted Re: Field extraction from table values on Splunk Search. 12-01-2022 09:49 PM
- Posted Help with field extraction from table values on Splunk Search. 12-01-2022 09:43 PM
- Posted Re: How to get same values from mutlivalue field on Knowledge Management. 10-04-2022 03:01 AM
- Karma Re: How to get same values from mutlivalue field for ITWhisperer. 10-04-2022 03:00 AM
- Posted Re: How to get same values from mutlivalue field on Knowledge Management. 09-30-2022 06:18 AM
- Posted Re: How to get same values from mutlivalue field on Knowledge Management. 09-30-2022 06:14 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-31-2019
06:08 PM
@thaynaminuzzo ,
Please share your email id.
... View more
07-17-2019
09:58 PM
yes it worked for me also...... Thanks for your code....@phoenix_down
... View more
06-20-2019
04:46 AM
Thanks for your answer @harsmarvania57
... View more
06-20-2019
04:46 AM
Thanks for your answer @FrankVI
... View more
06-20-2019
12:25 AM
Hi,
We have attached log file.link text The whole log file contains in one single event in splunk.
Now, I need to extract data(filename, date, time) from only last lines of text.
ex:
Try upload file :
Upload File D:\Program Files\X529\Matrix IT Software PK\PTS\Files\JobLettrers\BAAppointmentLetters_2016_4_9_13_0.csv Complete, status : 226 Transfer complete.
Closing log at 2:00:56 PM on 4/29/2016
to extract this I tried with my below SPL:
index="main" source="Sample_log.txt" | rex field=log "Try upload file : (?<file>.*)\nUpload File (?<msg>.*)([\S\s\n]*)\nClosing log at (?<time>.*) on (?<date>.*)" | table file msg time date
but this regex is not working as it capture many of line of text in log field and consider the only first one.link text
Please suggest. Thanks.
Dhirendra
... View more
06-19-2019
12:22 AM
I am trying to extract a filename Nsences_2016_10_10_12_50.csv from below field value.
D:\Program Files\X620\ABC\TGF\Files\sss\Nsences_2016_10_10_12_50.csv Complete, status : 226 Transfer complete."
| rex field=raw_field "D:\\(.+\\)*(?<filename>.*)\.csv Complete, status : 226 Transfer complete.
I am extracting as below.
| makeresults
| eval raw_field="D:\Program Files\X620\ABC\TGF\Files\sss\Nsences_2016_10_10_12_50.csv Complete, status : 226 Transfer complete."
| rex field=raw_field "D:\\(.+\\)*(?<filename>.*)\.csv Complete, status : 226 Transfer complete."
| table raw_field filename
Please help me. Thanks in advance.
Dhirendra
... View more
04-19-2019
01:07 AM
1 Karma
shared in your mail...
... View more
04-16-2019
05:42 AM
ok understand .. I will follow the natural approach of splunk..and use the same colors for same result .. 🙂
Thanks @woodcock for the suggation.
... View more
04-16-2019
12:57 AM
Thanks for your suggesation @grittonc ...yes we can by this but it will differ from our requirement.
Hi...@somesoni2 @woodcock @martin_mueller @niketnilay ...do you have any other suggestion please.
Thanks you.
... View more
04-15-2019
09:42 AM
Hi @efavreau yes you are right I am using trails visualization <option name="trellis.enabled">1</option>
my SPL is base search | stats count(status) by server status
... View more
04-15-2019
08:39 AM
1 Karma
Hi All,
Below is my requirement. I need to create pie chart with different colors as per attached SS.
I searched a lot but not able to find the solution and Below code would not help for this scenario.
<option name="charting.fieldColors">{"Error: 0xE4002B, "Success": 0x3b7d3e}</option>
Could you please suggest me on this.
Thanks in advance.
... View more
04-10-2019
07:57 AM
Right this one easier and quickly too...!! thanks 🙂
... View more
03-24-2019
11:47 AM
@bogdan_nicolescu Please share your email id,
Thanks
... View more
03-12-2019
11:31 AM
@alemarzuTM ... shared..!!
... View more
03-07-2019
02:39 AM
Hi @sdchakraborty Thanks for your answer. can you please put your comment in Answer section so that I can accept your answer.
Thanks,
Dhirendra
... View more
03-05-2019
06:10 AM
Hi @tiagofbmm ,
Sorry for late reply and thanks for your answer. I have formatted my data as below:
msg:server notice notification failed
{"isJoi":true,
"name":"NotificationError",
"details":
[{
"message":"\"there is an error\" might be 6 letters",
"path":[],
"type":"yetrn.hsnk",
"context":{
"tshdi":4,
"value":
[{
"id":0,
"name":"BHE Camel Lakne",
"email":"xyz.abc@abc.com",
"phone":"1",
"title":"This is text message",
"isActive":true
}],
"label":"contacts to save"
}
}],
"_object":
[{
"id":0,
"name":"BHE Camel Lakne",
"email":"xyz.abc@abc.com",
"phone":"1",
"title":"This is text message",
"isActive":true
}],
"isBosom":true,
"isSrsgver":false,
"data":null,
"output":
{
"statusCode":400,
"gstaflsoad":
{
"statusCode":400,
"error":"Bad Request",
"message":"\"there is an error\" might be 6 letters or 5 words",
"validation":
{
"source":"thsgmn",
"keys":[""]
}
},
"headers":{}
}
}
Could you please suggest How to extract in their respective fields.
Thanks.
... View more
03-02-2019
12:27 AM
Hi All,
My base search has a field "msg" , that contain below json data.
{"level":50,"time":1550758285865,"msg":"validate fail {\"isPP\":true,\"name\":\"ValidationError\",\"details\":[{\"message\":\"\\\" ghdsg to kjsd \\\" udnd nsbd at sndj 4 \\",\"path\":[],\"type\":\"hdyn.min\",\"context\":{\"jdhn\":4,\"value\":[{\"id\":0,\"name\":\"Thdaj JHD KJJ \",\"email\":\"abc@xyz.com\",\"phone\":\"1\",\"title\":\"GSTb SK Issue - KJDK JHDJ hours\",\"isSy\":true}],\"label\":\"ghdsg to kjsd\"}}],\"_object\":[{\"id\":0,\"name\":\"Thdaj JHD KJJ \",\"email\":\"abc@xyz.com\",\"phone\":\"1\",\"title\":\"ajsdj Insdkssue - YTSV working hours\",\"isActive\":SG}],\"isFF\":true,\"isGtsver\":false,\"data\":null,\"output\":{\"statusCode\":400,\"jdjkdjk\":{\"statusCode\":400,\"error\":\"Bad Request\",\"message\":\"\\\"jdjnis jds kdskd \\\" udnd nsbd at sndj 4 items\",\"validation\":{\"source\":\"yejdhi\",\"keys\":[\"\"]}},\"headers\":{}}}","pid":87487,"hostname":"ip-55423-762-232-636.dsdf.jds.ksndkd.ksmd","v":1}
Our requirement is that extracting above json data into field which are same as Key in json.
eg.
msg --> validate fail
isPP --> true
name --> ValidationError
statusCode --> 400
hostname --> ip-55423-762-232-636.dsdf.jds.ksndkd.ksmd
my search query is like below, but it didn't work:
host="ITEM-s73365" index="tms_app" sourcetype="tms_transport_app" | spath| rename msg.name as messageName ,msg.details as msgDetails| eval msgDetails = trim(msgDetails,"\")| table _time messageName msgDetails
Could you please suggest?
Thanks in advance.
... View more
01-18-2019
11:01 AM
Excellent!!.. On the first try, Query generated exact expected result. Thank you Sid. 🙂
... View more
01-18-2019
04:21 AM
Hi All,
My base search has a "tags" field, which contains 10 values. Another lookupfile has the the same column tags with total 24 values inside.
Now, I have to match tags field values into the lookup file.
I need a table with tags and status . tags contains all the values(24) and status will be OK or Not OK based on match result with tags field values in my search.
Could you please suggest?
Thanks in advance.
Example:tags in my search :
Please refer SS for more info.
Dhirendra
... View more
01-17-2019
09:00 PM
I never check for v3.1.4
... View more
01-17-2019
08:59 PM
1 Karma
Hi @behudelson Did you restart the splunk after removing dbconnect app folder.
Please follow the process below:
1- Remove the splunk_app_db_connect folder from apps
2- Restart the splunk(then it will remove app completely otherwise not)
3- Install DBConnect v3.1.2
Thanks.
... View more
01-16-2019
06:01 AM
Sure.. Thank you @behudelson
... View more
01-15-2019
07:11 AM
5 Karma
Hi @behudelson ,
I got this issue and it's related to HEC (HTTP Event Collector) Error, DB Connect injects data in Splunk using HEC. Unfortunately, this problem will occur only with MS server and DB Connect v 3.1.3 .
To resolve this issue, you need to uninstall DBConnect v3.1.3 and Install DBConnect v3.1.2 .
Thanks.
Dhirendra
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-14-2024
03:17 AM
|
Karma from
