Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About moiezuddin
moiezuddin
Explorer
Member since:
01-20-2015
06-05-2020
Community Statistics
| Posts | 57 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 01-20-2015 |
Activity Feed
- Got Karma for Re: How to build a dashboard to show extracted email details from a log file?. 06-05-2020 12:47 AM
- Posted If anyone of you or your teams have implemented Splunk in production, kindly share the following details ? on Splunk Search. 02-04-2016 05:56 AM
- Tagged If anyone of you or your teams have implemented Splunk in production, kindly share the following details ? on Splunk Search. 02-04-2016 05:56 AM
- Posted Re: Can anyone regex the time out in my search? on Splunk Search. 04-29-2015 12:37 AM
- Posted Re: Can anyone regex the time out in my search? on Splunk Search. 04-29-2015 12:25 AM
- Posted Re: Can anyone regex the time out in my search? on Splunk Search. 04-29-2015 12:11 AM
- Posted Re: Can anyone regex the time out in my search? on Splunk Search. 04-29-2015 12:10 AM
- Posted Re: Can anyone regex the time out in my search? on Splunk Search. 04-29-2015 12:04 AM
- Posted Re: Can anyone regex the time out in my search? on Splunk Search. 04-28-2015 11:58 PM
- Posted Re: Can anyone regex the time out in my search? on Splunk Search. 04-28-2015 11:44 PM
- Posted Can anyone regex the time out in my search? on Splunk Search. 04-28-2015 08:41 AM
- Tagged Can anyone regex the time out in my search? on Splunk Search. 04-28-2015 08:41 AM
- Tagged Can anyone regex the time out in my search? on Splunk Search. 04-28-2015 08:41 AM
- Posted Re: How to get user once per minute? on Splunk Search. 04-28-2015 07:16 AM
- Posted Re: How to get user once per minute? on Splunk Search. 04-28-2015 07:15 AM
- Posted Re: How to get user once per minute? on Splunk Search. 04-28-2015 07:12 AM
- Posted Re: How to get user once per minute? on Splunk Search. 04-28-2015 05:58 AM
- Posted Re: How to get user once per minute? on Splunk Search. 04-28-2015 05:49 AM
- Posted Re: How to get user once per minute? on Splunk Search. 04-28-2015 12:27 AM
- Posted Re: How to get user once per minute? on Splunk Search. 04-27-2015 11:58 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-07-2015
07:18 AM
How to get the details of field app=sencer, when it not shown in the values for the app field?
... View more
04-07-2015
03:39 AM
Thanks a lot , its working fine.
... View more
04-07-2015
01:57 AM
index=casm_prod sourcetype=smtrace | bucket _time span=1m | stats count by _time, USER_id | sort - count
With the above query, I noticed that USER_id are able to be found many times each minute.
I need to fiter this in such a way that it only needs to shows once per minute.
Kindly help
... View more
04-07-2015
12:11 AM
index=casm_prod sourcetype=smtrace | bucket _time span=1m | stats count by _time, USER_id | sort - count
With the above query, I noticed that USER_id are able to be found many times each minute.
I need to fiter this in such a way that it only needs to shows once per minute.
Kindly help
... View more
04-06-2015
06:54 AM
In the index for siteminder called cams_prod, there are traced filed with the type smtrace. Using these trace files find the logs for the application using 'Center realm’. Then created a regular expression to mine the User id. You will notice that Userids are able to be found many times each minute. We need to fiter this so it only shows once per minute.
... View more
- Tags:
- how
03-19-2015
03:10 AM
Hi,
i made some changes to your given query now it is showing results.
Thank you for your input..
... View more
03-19-2015
01:51 AM
Not working tried it.
thanks for the effort
... View more
03-19-2015
01:50 AM
Hi cheimell,
The clear information given at below link
http://answers.splunk.com/answers/221255/how-to-build-a-dashboard-to-show-extracted-email-d.html
(Unable to copy that link some attributes missing so i given aove link)
At the end this link u can able to find one query, (Showing exact result )
to that query i need add some more fields to get result
The fields need to add are jobTitle orgName orgSegment parentOrgname userType
Kindly help on it
... View more
03-19-2015
12:19 AM
I have a source="/opt/www/logs
i need the fields jobTitle , orgName , orgSegment , parentOrgname , and userType
Can anyone help provide the search?
... View more
03-19-2015
12:03 AM
Hi,
Can you help me to add 2 more fields it the above query please
Fields are jobTitle, orgName, userType
Thanks
... View more
03-18-2015
11:15 PM
Hi,
its not working
the lookup table present in field definition not in automatic lookups
if i deleted lookup table automatic lookups my query also dosent work.
Can you help me to right query with regex or some other possibulities
Even i am unable to use field extractor because mentioned fields are not present in the logs .
All the required fields are present in the lookup table
Please help on it
... View more
03-18-2015
11:11 PM
Hi Kendrickt,
Thanks for your explanation.
The problem is In sample data mentioned fields are not present, so unable to extract field
we have a lookup table name as identity_lookup in which the fields are present.
identity_lookup is present in lookup definition not in automatic lookup
With the help of identity_lookup table can you able to provide me query which can extract the requested fields
Can you help on it
... View more
03-18-2015
11:06 PM
HI ,
In sample data mentioned fields are not present
we have a lookup table name as identity_lookup in which the fields are present.
Can you help on it
... View more
03-18-2015
07:52 AM
I have a search:
source="/opt/www/logs/nbcucentral/nbcucentral.log"| rex "(?P\w+.\w+@\w+.\w+)" | rex "details (?P\w+)" | rex "(?\d{9})" | stats count by Name, Email, User_ID
It is showing the result of fields Name , Email , sso
Now i need to add some more fields to the existing query..
Fields which i need to add are:
jobTitle
orgName
orgSegment
parentOrgname
userType
Kindly help on it
... View more
03-17-2015
11:58 PM
just created this Automatic lookups
source="/opt/www/logs/BBCcentral/BBCcentral.log" sso!="" | table jobTitle orgName orgSegment parentOrgname userType.
Its worked
... View more
03-17-2015
05:59 AM
can you give one example how to right it with the
source="/opt/www/logs/BBCcentral/BBCcentral.log" and lookup table name (identity_lookup)
Fields are jobTitle orgName orgSegment parentOrgname userType
... View more
03-16-2015
06:49 AM
1,Use the lookup table identity_lookup and match it to the sso field to get the jobTitle orgName orgSegment parentOrgname userType
source="/opt/www/logs/BBCcentral/BBCcentral.log"
In first search above logs iam unable to find any field (jobTitle orgName orgSegment parentOrgname userType, sso)
but all the fields are present in the lookup table (identity_lookup)
Kindly help me how to built
Kindly help ASAP.
... View more
- Tags:
- how
03-11-2015
04:14 AM
1 Karma
I did like this
source="/opt/www/logs/nbcucentral/nbcucentral.log" | rex "(?P\w+.\w+@\w+.\w+)" | rex "(?i)^(?:[^\\[]*\\[){5}(?P[^\\]]+)" | rex "details (?P\w+)" | stats count by Name, SSO, Email | Head 20
Its working showing the results exactly thank you very much for your time .
Great work boss .. 🙂
... View more
03-11-2015
04:11 AM
I did it in the below way
source="/opt/www/logs/nbcucentral/nbcucentral.log" | rex "(?P\w+.\w+@\w+.\w+)" | rex "details (?P\w+)" | rex "details (?P\w+)" | stats count by Name, SSO, Email | Head 20
Here i added SSO field
SSO field need to show Userid like 2065554822
But sso field showing name of the user not his userid .
What i need to do ? Kindly assist
... View more
03-11-2015
02:28 AM
Thank you very much for your help.
Result showing in the dashboard is excellent
One thing is missing SSO
SSO is a field for getting userid"S
so how can i add SSO field in the QUERY
... View more
03-11-2015
12:01 AM
Thanks for your effort , but still its not working.
I extracted new fields and tested and named the fields as per my requirement.
Now its showing the results
source="/opt/www/logs/nbcucentral/nbcucentral.log" LastName=* OR Email=* OR SSO=* | table SSO,Email,LastName
Can you please let me know how to get top 20 results of the above query.
... View more
03-10-2015
02:34 AM
Its not working , can you please come up with another example , thanks for quick response
... View more
03-10-2015
01:53 AM
It doesnot work
source="/opt/www/logs/nbcucentral/nbcucentral.log"| rex "(?Pw+.w+@w+.w+)" | rex "details (?Pw+)" | table Name Email
showing error
Error in 'rex' command: Encountered the following error while compiling the regex '(?Pw+.w+@w+.w+)': Regex: unrecognized character after (?P
The search job has failed due to an error. You may be able view the job in the Job Inspector
... View more
03-09-2015
11:30 PM
Please help to create a dashboard for log file. /opt/www/logs/nbcucentral/nbcucentral.log to extract users sso, last name, and email address
examples of this log file. /opt/www/logs/nbcucentral/nbcucentral.log
[09/03/2015] [06:57:57.510] [INFO ] [FILE: com.nbcu.registration.VerifyMailServlet.doPost() IP:- 10.99.145.82] [206456577] [User details Lipsit, Christopher :: Chri.Lipsit@bolfchannel.com]
[09/03/2015] [06:28:42.976] [INFO ] [FILE: com.nbcu.registration.VerifyMailServlet.doPost() IP:- 10.99.145.145] [206457105] [User details Pelfrey, John :: John.Pelf@bolfchannel.com]
[09/03/2015] [05:13:50.242] [INFO ] [FILE: com.nbcu.registration.VerifyMailServlet.doPost() IP:- 3.161.145.238] [206453165] [User details Douguet, Juliette :: Julie.Dou@bcun.com
... View more
03-01-2015
10:29 PM
Thanks for your response , Its worked. I appreciate.
... View more
- « Previous
-
- 1
- 2
- Next »
