I want to remove from _raw data ... View more

yes i have to remove the message ... View more

When i use this query i have start time and stop time index=test_prod URI=/member*| eval StartTime=strftime(_time,"%Y/%m/%d %H:%M:%S")| head 1 | append [search index=test_prod URI=/member*| eval EndTime=strftime(_time,"%Y/%m/%d %H:%M:%S")| tail 1] | transaction URI 9/20/17 4:27:18.570 PM SPLUNK-TRACE-DateandTime - 2017-09-20 16:27:18.570 ThreadID=200;ThreadIDHex=00000;ThreadName=[WebContainer : 10];Node=MBR2:8448;meta-transid=INTERNAL_4f2d8b-11-48-8d-8e1776;ConsumerSenderID=NA;URI=/member*; TranasactionStartTime=2017-09-20 16:27:15.645;TransactionEndTime=2017-09-20 16:27:18.570;TransactionStatus=SUCCESS;Method=GET;StatusCode=200;Backend=;ErrorMsg=;JDBCInvocation=;JDBCWaitTime=;CacheContentFlag=UNKNOWN;CaptureLocation=Response; 9/20/17 12:30:10.908 PM SPLUNK-TRACE-DateandTime - 2017-09-20 12:30:10.908 ThreadID=2084;ThreadIDHex=00000;ThreadName=[WebContainer : 2];Node=MBR8:8448;meta-transid=INTERNAL_f63e8-184e-49b-96d-8bbff0e5;ConsumerSenderID=NA;URI=/member*;TranasactionStartTime=2017-09-20 12:30:10.908;TransactionEndTime=NA;TransactionStatus=;Method=GET;StatusCode=;Backend=GetMber, GetContact-dal;ErrorMsg=;JDBCInvocation=;JDBCWaitTime=;CacheContentFlag=UNKNOWN;CaptureLocation=Request; ... View more

That only i dont know how to do.so i tried tail 1 command for last event time ... View more

one of the job is running from 12 to 5.In the time i need to find start time and end time . for ex: if the job starts at 12.30 i need to trigger email as job started . but for end time i dont know how to find end time and how to send mail for job completed .i dont have any start stop string in the event ... View more

Hi DalJeanis, I have two servers .in both two servers splunk forwarder is installed and pointed to index=test.The both servers have same level or more or less of transaction .but in my case the one server have 35 % and another server having 34 % means not a problem . In case of large difference between the percentage in two servers .then i need to set alert for the conditions ... View more

Hi cmerriman, Thanks for your valuable query .but requirement is to find percentage of host.i have two servers one is host 1 and another one is host 2.both host have almost same transaction amount. for eg : host 1 : 5.1% host 2: 4.9% In case of host have huge difference between transaction amount for eg: host 1: 5.1 host 2: 2.0 i need to set an alert for this differnce ... View more

How to identify if there is a large variation in count between host1 and host 2 ? ... View more

Thanks i have to extract only 500 ? Server returned HTTP response code: 500 for My regex: rex field=_raw "Server returned HTTP response code:\s(?.+)" i have to trim only 500 ... View more

in sample.csv i added jvm names eg: node1,node2......,node24 ... View more