Hi, i have endpoints which are extracted from the log message and some end points are with numbers at the end. can we replace those last digits with * here is the extracted field and values uri = private/credentials/products/CCSID/1001111335764 uri=private/credentials/products/CCSID/1001111336914 can we display like below uri = private/credentials/products/CCSID/* uri=private/credentials/products/CCSID/* ... View more

hi, we running load test on 6 of the micro services and each has different API. we are indexing those logs into Splunk for monitoring. log has a details like org name,app name,session id,uri,msg,ResponseTime,ResponseCode etc i extracted all them in Splunk and each has some values. session id we can find after endpoint /public/sso/keepalive|79BF94E2-8165-b302-2869-28cc942d6e /public/sso/keepalive|79BF94E2-8165-b302-2869-28cc942d6e incoming flow always starts from application app-ca-sit and makes a call to app-sso-sit, this process and complete the request and see this app alone responsetime in 2nd log 1st log also shows responsetime but it gives you the total response time of both micro services. how can we show or display application response times in order? i am attaching sample diagram which has a good understanding. <6>2017-01-25T22:47:16Z 0ke4hjl7eph doppler[22]: {"cf_app_id":"012b7380-c96c-46e6-a57e-b96fd1f7266c","cf_app_name":"app-ca-sit","cf_ignored_app":false,"cf_org_id":"fd12558e-ddaf-4dd2-91b3-85f28ccd27f3","cf_org_name":"SYSTEM","cf_origin":"firehose","cf_space_id":"f9e2c3b9-ff7a-46b2-b359-9ec4ec13487b","cf_space_name":"lab","deployment":"cf","event_type":"LogMessage","ip":"168.72.186.55","job":"diego_cell-partition-ee9c6bad3843f162447f","job_index":"6","level":"info","message_type":"OUT","msg":" INFO [nio-8080-exec-3] c.c.c.l.c.f.CCPLoggingContextFilter c.c.c.l.c.f.CCPLoggingContextFilter.postProcess(CCPLoggingContextFilter.java:187) - POST|/public/sso/keepalive|79BF94E2-8165-b302-2869-28cc942d6e|9207ccf1-056e-41f9-be87-72e702ddf93c|US|GCB|MBK||METRICS|ResponseCode=200|ResponseTime=53","origin":"rep","source_instance":"0","source_type":"APP","time":"2017-01-25T22:47:16Z","timestamp":1485384436814105817} <6>2017-01-25T22:47:16Z v2d4vnhslen doppler[19]: {"cf_app_id":"6b3e0a17-c90e-4921-8bb5-d01dbc4fc768","cf_app_name":"app-sso-sit","cf_ignored_app":false,"cf_org_id":"fd12558e-ddaf-4dd2-91b3-85f28ccd27f3","cf_org_name":"SYSTEM","cf_origin":"firehose","cf_space_id":"f9e2c3b9-ff7a-46b2-b359-9ec4ec13487b","cf_space_name":"lab","deployment":"cf","event_type":"LogMessage","ip":"168.72.186.50","job":"diego_cell-partition-ee9c6bad3843f162447f","job_index":"1","level":"info","message_type":"OUT","msg":" INFO [io-8080-exec-18] c.c.c.l.c.f.CCPLoggingContextFilter c.c.c.l.c.f.CCPLoggingContextFilter.postProcess(CCPLoggingContextFilter.java:187) - POST|/public/sso/keepalive|79BF94E2-8165-b302-2869-28cc942d6e|9207ccf1-056e-41f9-be87-72e702ddf93c|US|GCB|MBK||METRICS|ResponseCode=200|ResponseTime=44","origin":"rep","source_instance":"0","source_type":"APP","time":"2017-01-25T22:47:16Z","timestamp":1485384436812148138} ... View more

Hi can you help us to extract values from log like ACTION, URI and response_time i used extract kvdelim=":" pairdelim="," but it is not extracting response time. ACTION=DELETE,POST,GET etc URI's = endpoints <6>2017-01-23T19:17:45Z v204vtn756h doppler[19]: {"cf_app_id":"012b7380-c96c-46e6-a57e-b96fd1f7266c","cf_app_name":"nam-ccp-psg-sit","cf_ignored_app":false,"cf_org_id":"fd12558e-ddaf-4dd2-91b3-85f28ccd27f3","cf_org_name":"NAM-US-CCP","cf_origin":"firehose","cf_space_id":"f9e2c3b9-ff7a-46b2-b359-9ec4ec13487b","cf_space_name":"lab","deployment":"cf","event_type":"LogMessage","ip":"168.72.186.232","job":"router-partition-ee9c6bad3843f162447f","job_index":"1","level":"info","message_type":"OUT","msg":"nam-ccp-psg-sit.cfapps-gcg-nonprd.nam.nsroot.net - [23/01/2017:19:17:45 +0000] \"POST /public/sso/keepalive HTTP/1.1\" 200 0 0 \"-\" \"Apache-HttpClient/4.1.1 (java 1.5)\" 153.40.245.130:15583 x_forwarded_for:\"169.193.222.122\" x_forwarded_proto:\"http\" vcap_request_id:896fa122-a994-4ec1-6ac0-1af149ef9580 response_time:0.041984457 app_id:012b7380-c96c-46e6-a57e-b96fd1f7266c\n","origin":"router__1","source_instance":"1","source_type":"RTR","time":"2017-01-23T19:17:45Z","timestamp":1485199065878351999} <6>2017-01-23T19:17:45Z 2ejr1t83au3 doppler[19]: {"cf_app_id":"3e0f31ee-f09c-46bf-a072-baef9e0c7763","cf_app_name":"nam-ccp-eureka-lab","cf_ignored_app":false,"cf_org_id":"dfeebb94-7a1c-4889-aa76-bb77852e434d","cf_org_name":"NAM-US-CCP","cf_origin":"firehose","cf_space_id":"b2abf80f-0543-4578-88d2-e7222f3d7b70","cf_space_name":"LAB","deployment":"cf","event_type":"LogMessage","ip":"168.72.205.254","job":"router-partition-a2833c853cfafee70104","job_index":"1","level":"info","message_type":"OUT","msg":"nam-ccp-eureka-lab.cfapps-gcg-gtdc1.citipaas-dev.dyn.nsroot.net - [23/01/2017:19:17:45 +0000] \"GET /eureka/apps/delta HTTP/1.1\" 200 0 89 \"-\" \"Java-EurekaClient/v1.4.6\" 153.40.245.130:46769 x_forwarded_for:\"168.72.205.134\" x_forwarded_proto:\"http\" vcap_request_id:4a46950c-7d18-4bed-7c98-833891c3358c response_time:0.001204662 app_id:3e0f31ee-f09c-46bf-a072-baef9e0c7763\n","origin":"router__1","source_instance":"1","source_type":"RTR","time":"2017-01-23T19:17:45Z","timestamp":1485199065824270851} ... View more

Hi, i have created some visualizations in my local Splunk (6.5.1) for vmstat,sar,sar2,iostat etc. when i use multikv in search, i see fields are extracting. when i implement the same in actual Splunk machine (6.4.2) with multikv , fields are not extracting. i am attaching the indexed logs. any help is appreciated. ... View more