Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About karthi2809
karthi2809
Builder
Member since:
12-07-2016
02-02-2026
Community Statistics
| Posts | 295 |
| Solutions | 0 |
| Karma Given | 116 |
| Karma Received | 6 |
| Member Since | 12-07-2016 |
Activity Feed
- Posted How write qery instead of using Join? on Splunk Search. 02-02-2026 05:54 AM
- Posted How to rename dynamic fields ? on Splunk Search. 11-27-2025 09:04 PM
- Posted Re: How to filter comma separate keywords in splunk dashboard using text box? on Splunk Search. 12-09-2024 03:54 AM
- Posted How to filter comma separate keywords in splunk dashboard using text box? on Splunk Search. 12-06-2024 05:51 AM
- Posted Re: How to filter events using text box values? on Splunk Search. 11-29-2024 03:34 AM
- Posted Re: How to filter events using text box values? on Splunk Search. 11-19-2024 03:58 AM
- Posted Re: How to filter events using text box values? on Splunk Search. 11-19-2024 12:58 AM
- Posted How to filter events using text box values? on Splunk Search. 11-19-2024 12:29 AM
- Tagged How to filter events using text box values? on Splunk Search. 11-19-2024 12:29 AM
- Karma Re: How to extract fields from source? for gcusello. 10-25-2024 03:28 AM
- Karma Re: How to extract fields from source? for Jawahir. 10-25-2024 03:28 AM
- Posted How to extract fields from source? on Splunk Search. 10-25-2024 02:33 AM
- Posted How to change UST timezone to PST time? on Dashboards & Visualizations. 09-30-2024 07:54 AM
- Posted Anypoint studio to splunk logs missing? on Getting Data In. 06-26-2024 06:04 AM
- Posted Re: Collecting server logs without installing Splunk UF? on Getting Data In. 06-19-2024 04:41 AM
- Karma Re: Collecting server logs without installing Splunk UF? for gcusello. 06-14-2024 06:52 AM
- Posted Collecting server logs without installing Splunk UF? on Getting Data In. 06-14-2024 03:04 AM
- Posted Re: Link url in splunk dashboard? on Splunk Dev. 06-05-2024 06:34 AM
- Posted Re: How to filter multivalue null values? on Splunk Search. 06-03-2024 08:08 AM
- Karma Re: How to filter multivalue null values? for bowesmana. 06-03-2024 08:07 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-21-2018
11:16 PM
In this how to get count
... View more
01-21-2018
09:33 PM
How to find count of empty values in splunk ?
raw events:
threadId = 2695;StartTime=2017.11.12.16.50.36.036;EndTime=; Poller;EntityID=409M5585440; TransactionStatus=;ErrorCode=;ErrorMessage=
threadId = 2695;StartTime=2017.11.12.16.50.36.036;EndTime=; Poller;EntityID=409M5585440; TransactionStatus=start;ErrorCode=;ErrorMessage=
threadId = 2695;StartTime=2017.11.12.16.50.36.036;EndTime=; Poller;EntityID=409M5585440; TransactionStatus=;ErrorCode=;ErrorMessage=60663a012118;Poller;EntityID=488M6027140;
How to find count of TransactionStatus=; for same threadId
... View more
01-16-2018
01:17 AM
1 Karma
How to rex using sed rex command?
index = main
| rex field=URI "^(?.+?)(\?|\z)"
|rex field=New_APIName mode=sed "s/\d+[a-zA-Z0-9*]/XXXX/g"
| stats count by New_APIName
I am getting output as
/v1/cp/members/XXXX/benefits/XXXXBG-XXXX-XXXX/benefitlist
/v1/cp/members/XXXX/benefits/XXXXBG-XXXX-XXXX-/excluded
/v1/cp/members/XXXX/benefits/XXXXUF-XXXX-XXXX-/benefitlist
/v1/cp/members/XXXX/benefits/XXXXUF-XXXX-XXXX-/excluded
/v1/cp/members/XXXX/benefits/XXXXUU-XXXX-XXXX-/benefitlist
/v1/cp/members/XXXX/benefits/XXXXUU-XXXX-XXXX-/excluded
/v1/cp/members/XXXX/benefits/XXXXXXXX-XXXX-XXXX-/benefitlist
/v1/cp/members/XXXX/benefits/XXXXXXXX-XXXX-XXXX-/excluded
Expected result:
/v1/cp/members/XXXX/benefits/XXXX/benefitlist
/v1/cp/members/XXXX/benefits/XXXX/excluded
... View more
01-15-2018
11:12 PM
Hi mayurr
Thanks for you valuable answer but i send sample URI .there is lot of URI like this how can we extract using mode=sed
... View more
01-12-2018
01:44 AM
i want to calculate failure status 404 for service name .when the status is reached 90% .I need to trigger email?
index=xxx* |eventstats count(eval(Proxy)) as "totcnt" count(eval(Status="404")) as "failurecnt" by Name |stats perc90(failurecnt) as perc90_avg by Name
... View more
12-19-2017
02:32 AM
Tue Dec 19 05:30:29 EST 2017Info: Trace: MessageID=66e0fb4b7a00 ; TransactionID=va10p40027-30801-14958502-24 ; URI=/v1/carealerts/message ; Environment=prod ; Proxy=CareAlerts-CORE-v1 ; TransactionReceivedStartTime=1513679429101 ; TransactionReceivedEndtime=1513679429102 ; RequestSentStartTime=1513679429109; RequestSentEndTime=1513679429109 ; ResponseReceivedStartTime=1513679429589 ; ResponseReceivedEndTime=1513679429590 ; TransationSentStartTime=1513679429600 ; TransactionSentEndtime=1513679429602 ; TargetHost=prods.com ; TargetBasePath=/CareManagement/1.0/CareAlertMessageRHI ; TargetCopySuffix=false ; TargetCopyQueryParams=true ; IsError=false ; Status=200 ; ErrorMsg=\x00
... View more
12-19-2017
01:30 AM
How to get response time from my search?
APIName is from my inputlookup
|inputlookup SolutionCenter.csv | append [search index=gee_sit |eval responseTime=TransactionSentEndtime - TransactionReceivedStartTime|eval responseTime=round((responseTime/1000),3)|stats avg(responseTime) by TargetBasePath ]|stats avg(responseTime) by TargetBasePath APIName
... View more
12-18-2017
10:53 PM
Thanks you mayurr98
... View more
12-18-2017
10:30 PM
How to extract time format using rex ?
TransactionStartTime=12/19/2017 06:23:35.474;
... View more
12-11-2017
05:49 AM
There are many API i need to extract all the API
/v1/caremanagement/utilizationmanagementinquiry/casesummary?id=260M58490
/v1/caremanagement/utilizationmanagementinquiry/casesummary?id=372A69838
/v0/providers/codes/list/AREA_OF_EXPERTISE
/v0/providers/codes/list/LANGUAGES
/v0/providers/codes/list/PATIENT_PREFERENCES
/v0/providers/codes/list/PROVIDER_TYPES
/v0/providers/details/byid/#####?sourcesystemid=0
/v0/providers/professionals/search
/v0/providers/specialities/list/C?levelofcareind=false
/v0/providers/specialities/list/C?levelofcareind=true
Expected result :
/v1/caremanagement/utilizationmanagementinquiry/casesummary
/v0/providers/codes/list
/v0/providers/specialities/list
... View more
12-11-2017
05:45 AM
My output:
/v0/providers/codes/list/LANGUAGES
/v0/providers/codes/list/PATIENT_PREFERENCES
/v0/providers/codes/list/PROVIDER_TYPES
/v0/providers/details/byid/#####?sourcesystemid=0
/v0/providers/professionals/search
/v0/providers/specialities/list/C?levelofcareind=false
/v0/providers/specialities/list/C?levelofcareind=true
/v0/providers/specialities/list/L?levelofcareind=false
/v1/caremanagement/utilizationmanagementinquiry/casesummary?id=260M58
/v1/caremanagement/utilizationmanagementinquiry/casesummary?id=372A69
Expected result is
/v0/providers/codes/list
/v0/providers/specialities/list
/v1/caremanagement/utilizationmanagementinquiry/casesummary
... View more
12-11-2017
05:02 AM
1 Karma
How to extract field using mode=sed for name extraction?
index=test Sender=PEGAS | rex field= URI"^(?.+?)(\?|\z)" | rex field=URI mode=sed "s/[0-9A-F]{32}/#####/g"
| rex field=URI mode=sed "s/[0-9]{7}[\w]{2}[\d]{4}/#####/g"
| stats count by URI
My output :
Expected result :
... View more
11-20-2017
01:39 AM
Hi elliotproebstel,
At that time we are taking backups files .so that time i dont need alerts .so i have to disable alert for that time.
... View more
11-19-2017
10:44 PM
Hi cusello,
The query is not working the alert is triggering at that time.
Thanks,
Karthigeyan
... View more
11-15-2017
09:16 PM
Hi Cusello,
index=docker fatal NOT date_hour>=1 AND (date_hour<7 AND date_minute<31)
will this query works.
... View more
11-15-2017
08:08 AM
How to customize alert should not trigger for particular time from 1 AM to 6.30AM?
... View more
- Tags:
- disable
- particular
11-15-2017
03:47 AM
How to add log file in whitelist for date append file?
Below is the file with date. Please help us to add those file in whitelist.
1)messages.log
2)messages_17.11.08_01.28.38.0
... View more
11-10-2017
05:08 AM
Thanks,
But i need to set up alert which start from next day 6 am and continuously for every three hours .before that i dont want to alert trigger.
... View more
11-10-2017
02:39 AM
I have a scenario that the alert need to be triggered at 6 AM , But i will get the logs from 3 AM ? How to set earliest and latest time stamp for the scenario?
In other words it should run every 3hrs. Please help me on same ?
I set earliest :@d+3h and latest :@d+6h
... View more
11-01-2017
05:26 AM
search not executed the minimum free disk space (2000mb) reached?
In /opt/splunk/var/run/splunk/distach --In this path i cleared the cache file and restarted search head
But in some case after restarting i will get same error .but i tried in some other browser (internet explorer) the search is working fine
what is the cause of issue?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-02-2026
05:37 AM
|
Karma from
| User | Karma Count |
|---|---|
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Karma given to
