About mikeyty07

mikeyty07 · ‎03-22-2023

I have this working query which needs some additional detailing. index=_internal earliest=-1h@h latest=@h | lookup api uri OUTPUT operation service | rex "duration=(?<response_time>[^,]+)" | multikv | eval ReportKey="Today" | append [ search index=_internal earliest=-7d-1h@h latest=-7d@h | lookup api uri OUTPUT operation service | rex "duration=(?<response_time>[^,]+)" | multikv | eval ReportKey="lastweek" | eval _time=_time+604800] | stats first(uri) as apiName avg(response_time) as avgresponse_time count by operationName ReportKey Is there a way to get like this where it will compare all average response time and then give the percentile differences. operation uri today_avg (response_time) lastweek_avg (response_time) % differrences avg(response_time) today count last week count abc /api/abc 222 333 12312 42343 xyz /api/xyz 867 4234 87978 67867

mikeyty07 · ‎03-21-2023

is there a way to alert an email if today's hourly stats are 25% higher than the previous week same day hourly stats?

mikeyty07 · ‎02-17-2023

How do i compare for todays let say 9a-10a with yesterdays 9a-10a stats side by side? Is it possible on 1 qeury? index=foo <query> | stats avg(responsetime) today and tomorrow count by uri

mikeyty07 · ‎12-21-2022

I am trying to search with specific date and time. Is it possible to search and compare? for example, i want to get stats from 2022-12-20 14:00:00 to 2022-12-20 15:00:00 and compare it with other dates like 12/16, 12/10/, 12/5 with same time range. is there a way to get stats compared side by side with other dates OR just have the all mentioned dates and time (2p-3p) there in search query ?

mikeyty07 · ‎12-17-2022

The rex search query is good which I can get the fields. Its the same field i am trying to match so it can produce all the results for one api. this is an example from my csv file. serviceName uri_path http_method apiName /google /page1/page1a/*/googlep1 post postusingRRR /google /page1/page1a/sada/*/googlep1 get getusingep2 /google /pag5/ggg/*/ooopp/ggplr delete deleteusing the /*/ value changes in logs so I'm using the apiName to connect. In real the api looks like this /google/page1/page1a/{pageNumber}/googlep1 Only issue is with the lookup. How do i use the wildcard on this?

mikeyty07 · ‎12-16-2022

I am using rex field to extract the field name and then inject the data so I can get only the desired fields but not able to do so. My Access logs: server - - [date& time] "GET /google/page1/page1a/633243463476/googlep1 HTTP/1.1" 200 350 85 My search query: <query> | rex field_=(?<SRC>\d+\.\d+\.\d+\.\d+).+\]\s\"(?<http_method>\w+)\s(?<serviceName>/[^/]+)(?<uri_path>[^?\s]+)\s(?<uri_query>\S+)\"\s(?<statusCode>\d+)\s(?<body_size>\d+)\s\s(?<response_time>\d+) My Search query with lookup <query> | rex field=_raw "(?<SRC>\d+\.\d+\.\d+\.\d+).+\]\s\"(?<http_method>\w+)\s(?<serviceName>/[^/]+)(?<uri_path>[^?\s]+)\s(?<uri_query>\S+)\"\s(?<statusCode>\d+)\s(?<body_size>\d+)\s\s(?<response_time>\d+)" |search serviceName="/google" | lookup abc.csv uri_path OUTPUT serviceName apiName | search searviceName=* operationName=* I am using above query to lookup from csv file but I get all the api has same count and not able to get the stats or logs for only particular. Is there a way to match this and produce result with both uri_path and api_name? can anyone please help me on this? Eg: csv file looks like this and i am trying to match apiName and uri_path so the logs are getting properly. serviceName uri_path http_method apiName /google /page1/page1a/*/googlep1 post postusingRRR /google /page1/page1a/sada/*/googlep1 get getusingep2 /google /pag5/ggg/*/ooopp/ggplr delete deleteusing

mikeyty07 · ‎12-15-2022

Yes. For example, I've data like this in csv file. The numbers are different each time so I am using this unique apiName field to gather how much of calls are going to particular api. with this search query i am able to see the apiName but when i select only one apiName it stills shows different other uri_path as well <my search query> | rex field=_raw "(?<SRC>\d+\.\d+\.\d+\.\d+).+\]\s\"(?<http_method>\w+)\s(?<serviceName>/[^/]+)(?<uri_path>[^?\s]+)\s(?<uri_query>\S+)\"\s(?<statusCode>\d+)\s(?<body_size>\d+)\s\s(?<response_time>\d+)"| search serviceName="*" | lookup abc.csv serviceName OUTPUT uri_path apiName serviceName uri_path http_method apiName /google /page1/page1a/*/googlep1 post postusingRRR /google /page1/page1a/sada/*/googlep1 get getusingep2 /google /pag5/ggg/*/ooopp/ggplr delete deleteusing But the two query doesnt seem to work

mikeyty07 · ‎12-15-2022

Thank you worked like a charm, however i used (?<uri_root>/[^/]+)(?<uri_path>[^?\s]+)\s(?<uri_query>\S+) uri_query seemed to give results for Http/1.1 can you also please check this? It is follow up question. https://community.splunk.com/t5/Splunk-Search/Using-lookup-command-after-rex-field/td-p/624450

mikeyty07 · ‎12-15-2022

My Access logs: server - - [date& time] "GET /google/page1/page1a/633243463476/googlep1 HTTP/1.1" 200 350 85 rex query: (?<SRC>\d+\.\d+\.\d+\.\d+).+\]\s\"(?<http_method>\w+)\s(?<serviceName>/[^/]+)(?<uri_path>[^?\s]+)\s(?<uri_query>\S+)\"\s(?<statusCode>\d+)\s(?<body_size>\d+)\s\s(?<response_time>\d+) Search query with lookup *some query* | rex field=_raw "(?<SRC>\d+\.\d+\.\d+\.\d+).+\]\s\"(?<http_method>\w+)\s(?<serviceName>/[^/]+)(?<uri_path>[^?\s]+)\s(?<uri_query>\S+)\"\s(?<statusCode>\d+)\s(?<body_size>\d+)\s\s(?<response_time>\d+)" | lookup abc.csv uri_path OUTPUT serviceName apiName I am using above query to lookup from csv file but not getting any results. In this lookup file i have these fields. apiName is the unique name in this csv file which i am trying to link with the uri_path but not able to do so. Is there a way to match this and produce result with both uri_path and api_name? can anyone please help me on this? serviceName uri_path http_method apiName /google /page1/page1a/633243463476/googlep1 post postusingRRR

mikeyty07 · ‎12-15-2022

the search didnt give any results, also how do i get results of all the other companies like facebook, twitter?

mikeyty07 · ‎12-14-2022

I have an access logs which prints like this server - - [date& time] "GET /google/page1/page1a/633243463476/googlep1?sc=RT&lo=en_US HTTP/1.1" 200 350 85 which rex is | rex field=_raw "(?<SRC>\d+\.\d+\.\d+\.\d+).+\]\s\"(?<http_method>\w+)\s(?<uri_path>\S+)\s(?<uri_query>\S+)\"\s(?<statusCode>\d+)\s(?<body_size>\d+)\s\s(?<response_time>\d+)" Is there a way to seperate uri into two or 3? /google/page1/page1a/633243463476/googlep1?sc=RT&lo=en_US TO /google /page1/page1a/633243463476/googlep1?sc=RT&lo=en_US OR /google /page1/page1a/633243463476/googlep1 ?sc=RT&lo=en_US

mikeyty07 · ‎11-21-2022

I have a dashboard with dropdown select. From this dropdown, once I select a api "/api/apiresponse/search/" then in the search results it will show this 2000-1-1 1:0:0.00 INFO : logType=API_RESPONSE, duration=100, request={"headers":"Accept":"application/json","Content-Type":"application/json"},"method":"POST", "body":{"body"},"parameters":{},"uri":"/api/apiresponse/search/"}, configLabel=, requestId=Thisoneismatching11111, response={"headers":{"statusCode":"OK"}, requestUri=/api/apiresponse/search/, threadContextId=Thisoneismatching22222, message=COMPLETED request /api/apiresponse/search/, source = /apps/logs/api_response.log sourcetype = response_log this is my search query for API_response index=main *_RESPONSE | spath input=request | spath input=response | lookup abc.csv uri OUTPUT opName | search Name="$Nme$" opName="$opeNme$" uri="$apis$" Downstream response log 2000-1-1 1:0:0.00 INFO logType=DOWNSTREAM_RESPONSE, duration=100, request={"headers":{"Accept":"application/json","Content-Type":"application/json"},"method":"POST", "body":{"uri":"https://abcdefg.com/downresponseservice/api/downresponse"}, configLabel=, requestId=Thisoneismatching11111, response={"OK":{"statusCode":"OK"}}, requestUri=https://abcdefg.com/downresponseservice/api/downresponse, threadContextId=Thisoneismatching22222, message=<<< Outbound REST response, source = /apps/logs/downstream_response.log sourcetype = response_log same way Is there a way to get downstream response? All the Api logs and downstream logs has two matching field requestId andthreadContextId I would need from the selected api, it has to get api_response logs and downstream logs related to only that api.

mikeyty07 · ‎11-18-2022

yup i wanted to see the other logs but through the selected api from dropdown, and get the logs of api logs and downstream logs on two different panel. but this search query is missing that thing.

mikeyty07 · ‎11-16-2022

i tried but it didnt work, shows all the logs. Not sure how to achieve it but from the dashboard perspective i chose the api then based on that api it has downstream which i am still confused how am i supposed to get the downstream response only through selected api's and these requestId/threadcontextId are matched only on which are hidden in logs. i believe it has to be coded with js or sth.

mikeyty07 · ‎11-16-2022

Here is the sample logs for API_Response and Downstream_Response. Only two fields are matching in this logs. 2000-1-1 1:0:0.00 INFO : logType=API_RESPONSE, duration=100, request={"headers":"Accept":"application/json","Content-Type":"application/json"},"method":"POST", "body":{"body"},"parameters":{},"uri":"/api/apiresponse/search/"}, configLabel=, requestId=Thisoneismatching11111, response={"headers":{"statusCode":"OK"}, requestUri=/api/apiresponse/search/, threadContextId=Thisoneismatching22222, message=COMPLETED request /api/apiresponse/search/, source = /apps/logs/api_response.log sourcetype = response_log 2000-1-1 1:0:0.00 INFO logType=DOWNSTREAM_RESPONSE, duration=100, request={"headers":{"Accept":"application/json","Content-Type":"application/json"},"method":"POST", "body":{"uri":"https://abcdefg.com/downresponseservice/api/downresponse"}, configLabel=, requestId=Thisoneismatching11111, response={"OK":{"statusCode":"OK"}}, requestUri=https://abcdefg.com/downresponseservice/api/downresponse, threadContextId=Thisoneismatching22222, message=<<< Outbound REST response, source = /apps/logs/downstream_response.log sourcetype = response_log From my Dashboard I am using inputlookup and based on the api it should show result for downstream as well. here is the query i used for my dropdown dashboard |inputlookup abc.csv| search Name="$Nme$" uri="$apis$" | dedup opName | table opName here is the search query, still not able to figure out index=main *_RESPONSE | spath input=request | spath input=response | lookup abc.csv uri OUTPUT opName | search Name="$Nme$" opName="$opeNme$" uri="$apis$"

mikeyty07 · ‎11-15-2022

How do I take the field from api_response and add it? Can you please give me an example. I thought of adding extra search space for TrackIdto add * for all and take that token to api_response and from that api_response tokens only to downstream but that would be too heavy, I guess.

mikeyty07 · ‎11-14-2022

I have a dashboard which show results through the selected dropdown. The selected api will display only api_resposne which it has corresponding downstream_response as well. But the issue is the downstream_response can only be searched with the trackid of api_response. is there a way to show the data of api_response corresponding with the results of downstream_response?

mikeyty07 · ‎07-29-2022

yes. I tried that too, but the search is happening for index=main user="Local Domain\\abc" which i tried to regex but it didnt display on dashboard but i can see the new field being created with. from dashboard i wanted to send the selected as token to get stats.

mikeyty07 · ‎07-29-2022

i have index=main user=Local Domain\abc it wont search any result but if i search with index=main user=Local Domain\\abc it works, i tried rex as well but it didnt work for my dashboard as it wont display any search, any solution to search without adding another \ to the search

mikeyty07 · ‎07-27-2022

I have a query for dropdown dashboard which is not working index=main reqUser="*" source="logs"| dedup reqUser and token is userReq from this i select one of it which will be used to search eg reqUser="local \abc" index=main reqUser={userReq} | stats avg(reqUser) by source, but its not showing any logs. i noticed the problem is local \abc which only accepts local \\abc. anyway i can rewrite this query?

mikeyty07 · ‎07-21-2022

I have apis which has params in between and trying to match the api from csv but it doesnt show when using lookup. eg : /serviceName/api/127364/api which is shown in access logs i have /serviceName/api/*/api in my csv file. Any idea how this works?

mikeyty07 · ‎03-07-2022

I am using timewrap to get the info for last 3 weeks and show data correspondly for 3 week with 3 different pie chart(when i activate the trellis layout). Although the data are correct it shows the chart where the dates are incorrect like they are showing the dates for current week for others previous week and last 2 weeks. How would i make it show each date data in 3 pie chart with 7 days data information. index=mysearch earliest=-21d@d latest=@d | timechart count span=1d | timewrap w

mikeyty07 · ‎06-29-2021

Thank you!! this works perfectly

mikeyty07 · ‎06-29-2021

i am actually searching dbquery so it wont show raw events but shows only stats https://abc.com/abc/api/cache postApiCache 13 https://abc.com/abc-track track 549 https://abc.com/bbc/api/apica postCache 15 https://abc.com/til/api/api ApiPOST 14 https://abc.com:443/efgh efgs 382

mikeyty07 · ‎06-29-2021

https://abc-google.com/ABC/abc/1342/abc ID-- getABC https://abc-google.com/CDE/abc/cde/abc/cde/111 ID--postCDE something like these

Posts	62
Solutions	0
Karma Given	19
Karma Received	1
Member Since	‎03-22-2021

Online Status	Offline
Date Last Visited	‎11-28-2023 08:01 PM

Is there a way to timewrap on stats for comparing ...

rex from the multivalue fields and get one particu...

How to search by _time from inputlookup csv file?

Why does splunk timepicker dashboard shows result ...

How to get the time difference of two timestamp i...

How can I inject all rex field events from 1st sea...

How to rex?

How to compare today hourly stats and previous wee...

How do I compare for todays and yesterdays stats/ ...

How to search by specific date and time range and ...

Re: compare today hourly stats and previous week s...

How to compare today hourly stats and previous wee...

How do I compare for todays and yesterdays stats/ ...

How to search by specific date and time range and ...

Re: Using rex to create a field and using lookup t...

How to use rex to create a field and using lookup ...

Re: Using lookup command after rex field?

Re: Is there a way to use rex to divide api name?

Is there a way to match this and produce result wi...

Re: Is there a way to use rex to divide api name?

Is there a way to use rex to divide api name?

Is there a way to show the data of api_response an...

Re: Is there a way to show the data of api_respons...

Re: Is there a way to show the data of api_respons...

Re: Is there a way to show the data of api_respons...

Re: Is there a way to show the data of api_respons...

Is there a way to show the data of api_response co...

Re: Why is my splunk search not working?

Why is my splunk search not working?

Why is my dashboard dropdown not working?

Does csv file accepts * symbol for lookup?

How to make timechart show each date data in 3 pie...

Re: How do i get the url without params

Re: How do i get the url without params

Re: How do i get the url without params