Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About gokadroid
gokadroid
Motivator
Member since:
10-06-2016
04-12-2025
Community Statistics
| Posts | 480 |
| Solutions | 113 |
| Karma Given | 121 |
| Karma Received | 235 |
| Member Since | 10-06-2016 |
Activity Feed
- Got Karma for Re: How to use regex to extract field?. 01-12-2026 05:34 PM
- Got Karma for Re: How to search for a range of IP addresses (example: 10.10.10.32 through 10.10.10.96)?. 01-12-2026 05:33 PM
- Got Karma for Re: How to search for a range of IP addresses (example: 10.10.10.32 through 10.10.10.96)?. 07-17-2025 07:49 PM
- Got Karma for Re: How to pull a audit trail logs who made changes from so and so dates, and i want to create a alert for that.. 07-31-2024 08:08 AM
- Got Karma for Re: How to pull a audit trail logs who made changes from so and so dates, and i want to create a alert for that.. 07-31-2024 08:07 AM
- Got Karma for Re: How to pull a audit trail logs who made changes from so and so dates, and i want to create a alert for that.. 07-31-2024 08:07 AM
- Got Karma for Re: How to search a lookup table and return the matching term?. 02-15-2024 10:08 AM
- Got Karma for Re: How to pull a audit trail logs who made changes from so and so dates, and i want to create a alert for that.. 07-10-2023 09:13 AM
- Got Karma for Re: How to pull a audit trail logs who made changes from so and so dates, and i want to create a alert for that.. 07-10-2023 09:13 AM
- Got Karma for Re: How to combine multiple searches and output results into one CSV file?. 02-09-2022 06:05 AM
- Got Karma for Re: inputlookup compare the field values in my logs with lookup table. 03-30-2021 05:37 PM
- Got Karma for Re: How to use rex to extract JSON text in "msg" keyValue pair?. 03-10-2021 07:36 PM
- Got Karma for Re: How to use rex to extract JSON text in "msg" keyValue pair?. 03-10-2021 07:36 PM
- Posted Re: How to use rex to extract JSON text in "msg" keyValue pair? on Splunk Search. 03-10-2021 07:20 PM
- Got Karma for Re: How to use rex to extract JSON text in "msg" keyValue pair?. 12-20-2020 02:06 PM
- Karma Re: How to use regex to extract field? for kiran331. 10-04-2020 07:01 PM
- Got Karma for Re: How to build a trend chart that compares today's result with previous day, week, and month for the same time frame?. 09-19-2020 07:23 PM
- Got Karma for Re: How to search for a range of IP addresses (example: 10.10.10.32 through 10.10.10.96)?. 07-07-2020 11:07 AM
- Karma Re: Head scratcher regex for elliotproebstel. 06-05-2020 12:49 AM
- Karma Re: Trying to get the domain from multiple email recipients using rex for micahkemp. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
04-17-2017
08:50 PM
How about showing the data in MB/h and then seeking that fluctuation if requirement permits.
... View more
04-17-2017
09:17 AM
Greedy approach shall work, but please be aware of pitfalls of being greedy which is discussed in this thread:
https://answers.splunk.com/answers/489539/bug-in-rex-command-not-working-if-the-raw-data-has.html
More on why this happens due to catastrophic backtracking here:
https://answers.splunk.com/answers/489539/bug-in-rex-command-not-working-if-the-raw-data-has.html#comment-488447
... View more
04-16-2017
11:57 PM
1 Karma
Since there is no sample data given, assuming you have data as below where string status=<singleDigit> can occur multiple times and this occurrence might also vary however many times within an event. (The query however works well for events where status=<singleDigit> phrase occurs same number of times within each event):
aa, status=0 status=0 status=0 status=0 status=0
bb, status=0 status=0 status=1
cc, status=1 status=1
dd, status=0
Then how about trying this one:
your query to return raw events
| rex max_match=0 field=_raw "status=(?<myStatus>\d)\s*"
| mvexpand myStatus
| stats sum(myStatus) as Sum by _raw
| eval new_field=if(Sum=0, "success", "failure")
| table _raw, new_field
Sample snapshot:
... View more
04-16-2017
11:34 PM
If you really want the formatting to be the way you mentioned in your question (using list), how about trying this below which will remove the duplicate problem first and then table it out like you want:
index=ao_status sourcetype=checkConfig
| rex "^.*\sConfig_Name=(?P[^\s]+)\sConfig_Status=(?P[^\s]+)"
| stats count by cfgName, cfgStatus, host
| stats list(cfgName) as "Config_Name", list(cfgStatus) as "Config_Status" by host
However I would suggest using the below one to keep track of the cfgName and cfgStatus mapping to host intact in all cases for scenarios where the status has more than one value for a particular config (exa. /etc/httpd.cfg having say NOT-OK first and then OK later on):
index=ao_status sourcetype=checkConfig
| rex "^.*\sConfig_Name=(?P[^\s]+)\sConfig_Status=(?P[^\s]+)"
| stats count by cfgName, cfgStatus, host
| table cfgName , cfgStatus, host
| rename cfgName as "Config_Name", cfgStatus as "Config_Status"
... View more
04-14-2017
11:13 PM
Assuming your intention was to catch the red pieces from this log line:
org.xml.sax.SAXParseException: cvc-maxLength-valid: Value Georgia Tech Yellow Jacke Heather Navy S Interbay Melange Stripe P' with length = '66' is not facet-valid with respect to maxLength '65' for type '#AnonType_DescriptionItemMessagetXML'.
How about you give this a try so that first text of interest gets caught in field from and second text of interest gets caught in field to , as is done in below query:
index=Mule source = "*item-subscriber-manhattan*" "*is not facet-valid with respect to maxLength '65' for type*"
| rex field=_raw ".*cvc-maxLength-valid:\sValue\s(?<from>.*)\sis not facet-valid with respect to maxLength '65'for type (?<to>.*)"
| timechart span=1d count by to useother=f usenull=f
Hope it helps! See extration here
... View more
04-14-2017
10:49 PM
How about trying this stanza to be put in your props.conf:
DATETIME_CONFIG =
MAX_DAYS_AGO = 7300
NO_BINARY_CHECK = true
TIME_FORMAT = %Y-%m-%d
TIME_PREFIX = date =
category = Custom
pulldown_type = true
I am attaching the jpg where I used some sample data locally and used additional MAX_DAYS_AGO setting to make the dates in your sample data to parse correctly into _time .
MAX_DAYS_AGO = 7300 is actually 20 years worth of days ignoring leap years (20*365). So if you think your data might have dates prior to that, choose this value accordingly. Let me know if this helped.
... View more
03-18-2017
02:39 AM
Thanks for the quick response but can you please provide computing the delta part of it?
... View more
03-18-2017
02:08 AM
I have data like:
timestamp, serviceName, responseTime(in ms)
I want to plot the per minute delta of avg. responseTime (difference between avg responseTime yesterday vs today) by serviceName . Average is taken every minute. I want to observe only half an hour window.
Sample data:
03/17/2017 00:00:01 service1 242
03/17/2017 00:00:02 service2 300
03/17/2017 00:00:03 service3 350
03/17/2017 00:00:04 service1 280
03/17/2017 00:00:05 service2 290
03/17/2017 00:00:06 service3 300
:
:
03/18/2017 00:00:01 service1 1242
03/18/2017 00:00:02 service2 1300
03/18/2017 00:00:03 service3 1350
03/18/2017 00:00:04 service1 1280
03/18/2017 00:00:05 service2 1290
03/18/2017 00:00:06 service3 1300
Now,
- The avg(ResponseTime) of service1 for 03/17/2017 00:00 is (242+280)/2 = 261ms
- The avg(ResponseTime) of service1 for 03/18/2017 00:00 is (1242+1280)/2 = 1261ms
- Hence the delta avg(RespTime) for service 1 at 00:00 between yesterday and today is 1261-261 = 1000ms. It might also be negative 1000 if it was 1261 yesterday and 261 today.
I want to plot this delta by service name on a timechart for a window of last 30 minutes from now only. Please assist.
NOTE
- Services are more than three
- One service might get called mote than other service within a minute. So service1 might get called multiple times within a minute while chances are service2 might not be called at all within that minute.
- There is no sequence in which services are called (sample data makes it look like service1, 2 and 3 are in sequence)
... View more
02-13-2017
09:08 AM
Those will be the script Ids which will not have either exit or terminated in status. Since above SPL starts with searching for ` log=Script hence for such scripts only one line will be there. So above SPL shall change something like this to filter pending ones only:
id script status host=d* script=test* "log=Script "
| rex field=_raw "log=Script\s*(?<statusString>[\S]+)"
| eval status=case(statusString=="started", "started", statusString=="exit", "success", statusString=="terminated", "failed", 1=1, "unknown")
| stats count by id
| where count < 2
... View more
02-12-2017
11:11 PM
Since all the lines of yours which has status have the keyword "log=Script " hence it's used to filter only those lines. For example see these:
Date = 02/10/17 14:15:00,script = testscript, id = 29251, log=Script started
:
Date = 02/10/17 14:15:00,script = testscript, id = 29251, log=Script exit normal
:
Date = 02/10/17 14:15:00,script = testscript, id = 29251, log=Script started
:
Date = 02/10/17 14:15:00,script = testscript, id = 29251, log=Script terminated
... View more
02-12-2017
10:24 PM
1 Karma
Assuming as per your comments if string £1,838.38 is coming in currency field as \xA31,838.38 then how about trying this:
Ensure currency has no commas to start with (if any)
Extract everything after \xA3 from currency field into a new field myCurrency
Format back myCurrency to use the £ symbol as a string.
Try below search which shall give you the results needed as stated above.
your base query to return your currency field
| rex field=currency mode=sed "s/,//g"
| rex field=currency "A3(?<myCurrency>.*)"
| fieldformat myCurrency ="£".tostring(myCurrency , "commas")
| stats sum(myCurrency )
Hope it helps. Below is the sample makeresults command i used to verify it was working.
... View more
02-11-2017
12:07 AM
1 Karma
How about trying this and see if it works out, assuming string is coming in currency field as £ 42 or £ 42.0 or £42 :
your base query to return your currency field
| rex field=currency "£\s*(?<myCurrency>.*)"
| fieldformat myCurency="£".tostring(myCurrency, "commas")
See example here
... View more
02-10-2017
11:58 PM
How about trying this and see if it works out for you:
id script status host=d* script=test* "log=Script "
| rex field=_raw "log=Script\s*(?<statusString>[\S]+)"
| eval status=case(statusString=="started", "started", statusString=="exit", "success", statusString=="terminated", "failed", 1=1, "unknown")
| eventstats min(_time) as start, max(_time) as end by id , script
| search status="exit" OR status="terminated"
| table id, script, status, start, end
| eval duration=end-start
| eval start=strftime(start, "%Y/%m/%d %T.%3Q")
| eval end=strftime(end, "%Y/%m/%d %T.%3Q")
... View more
02-10-2017
11:41 PM
Hope this helps:
host=web- "\"response_code\": 5," OR "\"message\": \"Application Error\"" OR "\"response_code\": 0"\"total_time\" userloans
| rex field=_raw "\"total_time\":\s*(?<totalTime>[^,\s]+)"
| where totalTime > 9
... View more
02-06-2017
06:03 PM
1 Karma
yes, that is the issue!! 6.4.x or higher is what's needed.
... View more
02-04-2017
05:50 PM
2 Karma
If you are happy to extract it in SPL (same regex can be used elsewhere like field extractor) then try to see if this works for you:
your base query to give field Referer
| rex field=Referer "https?:\/\/(?<FQDN>[^\/]+)\/.*"
| stats count by FQDN
See extraction here
... View more
02-03-2017
10:47 PM
I tried with sreamstats and you SPL seems to work fine with that argument in my local which is Splunk 6.5.x .
Infact the error that you are reporting shall come for following:
Error in 'eventstats' command: The argument 'reset_on_change=true' is invalid.
Error in 'stats' command: The argument 'reset_on_change=true' is invalid.
Error in 'sistats' command: The argument 'reset_on_change=true' is invalid.
Error in 'tstats' command: Invalid argument: 'reset_on_change=true'
... View more
02-03-2017
06:55 PM
1 Karma
Can you try this
| inputlookup product.csv
| rex field="start Time" "(?<bookingDate>[\S]+)"
| eventstats count by bookingDate
| search "Delivery success %"=100
| stats sum('Delivery success %') as SUM values(count) as COUNT by bookingDate
| eval deliveryPercent=round(SUM/COUNT, 2)
| fields - SUM,COUNT
Choose visualization as bar chart, take care of the field names in quotes and see whether really symbols like % appear in your field names or not (like is given in question).
Append the following line right at the end of the above query to get the date in the desired format
| eval bookingDate=strftime(strptime(bookingDate, "%m/%d/%Y"), "%d/%b")
... View more
02-03-2017
06:22 PM
How about trying this if you think its always the first sentence which you want to remove (assumption below is first sentence shall end in . OR ! OR ? which can be extended based on type of sentence ending punctuation):
index=indexname source="WinEventLog:Application" CNBD Employee
| rex field=Exception_Message "^.*?(\.|\!|\?)\s*(?<exception>.*)"
| table _time, host, exception
See extraction here
... View more
02-02-2017
03:28 PM
I see almost everything common between the two strings:
MessageFlow MsgFlowDetail 4 00005609588f0d40:0 2017-01-30 09:38:48 7676: Returned from SessionHandleMsg(200) for task 27263382, pErrStack = 0x2a2d6bf0
..
.. (after few events)
event n:
MessageFlow MsgFlowDetail 4 00005609588f0d40:0 2017-01-30 09:38:47 7676: Calling SessionHandleMsg(200) for task 27263382, pErrStack = 0x2a2d6bf0
... View more
02-02-2017
02:58 PM
1 Karma
Can you please check if the users who are not getting the result back have appropraite permission on these lookup table and lookup table definition .
You can check permissions on lu_cti_indicator of the by going into:
Settings » Lookups » Lookup definitions
Alternatively check also Settings » Lookups » Lookup table files
Check the scope of the app where users are trying to serach vs where lookup is uploaded.
... View more
02-02-2017
10:24 AM
Not sure why the extra space is coming through in token but can you please try to do these to see if it improves anything:
Replace pod="$pod_tok$" in your query to pod=$pod_tok|s$ if you want to wrap the token values with quotes around it. It might not help much but shall be the preferred way of "quoting" the token.
Remove the quotes around the field names in this part table "_time", "pod", "message", "referenceId", "exception", "errorDetails", "thread","processId", "levelInt", "userName" as fieldNames shall be recognized without the quotes too.
Try with pod=$pod_tok|n$ once which means no encoding. This is just a trial to see how does it change anything, if at all.
... View more
02-01-2017
11:16 PM
What happens when P6 fails but p5 passes?
And when p6 fails and p2 passes?
Also how are these processes distinguished in each run say, if the data needs a correlation between multi runs, like below, how can once distinguish between p1 of run 1 from p1 of run2,3 or 4:
run 1 - p1 pass; p2 pass; p4 pass; p6 pass
run 2 - p1 pass; p3 pass; p5 fails
run 3 - p1 pass; p2 fails; p4 pass; p6 pass
run 4 - p1 pass; p3 pass; p5 pass
... View more
02-01-2017
10:34 PM
I thought query was supposed catch that given you specifically wanted to catch multiple spaces as described here in original question:
It has multiple spaces after/log (here file name is data data2 data3)
/home/data/var/log/ data data2 data3
So can it be a fair statement that if the immediate string of last section has a <dot> in it signifying a file extension, stop there, else continue to capture as mentioned in highlighted requirement of capturing data data2 data3
... View more
02-01-2017
10:06 PM
Try this regex and see if it works out for your case:
...| rex "(?<myField1>[^\s:]+):*(?<myField2>\S*)"
See Extraction Here
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-12-2025
06:34 PM
|
Karma given to
