About Thulasinathan_M

Thulasinathan_M · ‎08-30-2023

Thanks, worked perfectly.

Thulasinathan_M · ‎08-30-2023

Thanks @ITWhisperer. This is exactly what I'm looking for, but my text comes from a token. If I do something like below, I get " Error in 'SearchParser': Mismatched ']'." <init> <eval token="input">"!@#$%^&*(){}|\";:<>/\\[]"</eval> </init> <row> <panel depends="$alwayshide$"> <html> <style> #escaped table tbody td div.multivalue-subcell[data-mv-index="1"] { display: none; } </style> </html> </panel> <panel id="escaped"> <table> <title>$escaped$</title> <search> <query>| makeresults | fields - _time | eval param="$input$" | eval param=mvappend(param,replace(param,"([!@#$%^&*\{\}\|\";:<>\/\\\[\]])","\\\\\1"))</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">cell</option> <option name="refresh.display">progressbar</option> <drilldown> <eval token="escaped">mvindex($click.value$,1)</eval> </drilldown> </table> </panel> </row>

Thulasinathan_M · ‎08-30-2023

Hi @gcusello, It can be anywhere in the text.

Thulasinathan_M · ‎08-30-2023

Hi Splunk Experts, I've a table and based on a click, I'm holding the value of field in token and using it in a different panel with search command. If there are any special characters the search is getting failed. I've tried replacing it with '*', but that gives me unexpected results. So I'm thinking of escaping all possible special characters in the token value. Please advice!! Ex: !@#$%^&*(){}|";:<>/\[] I want them as below: \!\@\#\$\%\^\&\*\{\}\|\"\;\:\<\>\/\\\[\]

Thulasinathan_M · ‎08-29-2023

After resetting token, it started working. Thanks!! 🙂

Thulasinathan_M · ‎08-29-2023

I think the issue is, at times I insert manual inputs in this textbox. So when I do that, on the further click the token value is not getting inserted properly. Wondering whether I should clear/reset the data/ token

Thulasinathan_M · ‎08-29-2023

Hi @gcusello Yes tried, but that doesn't seems to be working.

Thulasinathan_M · ‎08-29-2023

Hi Splunk Experts. I've a table with multiple fields, based on a click I've created a token to get a value of it. I need to pass this token's value to a Textbox of an another panel. Is it Possible. Please advice!!

Thulasinathan_M · ‎08-25-2023

Thanks @richgalloway!! That done the trick 😉

Thulasinathan_M · ‎08-25-2023

Something like this? | rex field=_raw "combinedrules\: \[(?<Rules>(.*[^(\]\,)?]))" | rex field=Rules max_match=0 "(?<RuleId>(\d+))" | stats count by RuleId

Thulasinathan_M · ‎08-25-2023

Hi Splunk Experts, I've a big list of rex commands in my search query. While using dashboard I added those rex commands in a token and used it in search panels because I've 3 to 4 panels, I don't want to re-write the same set of rex command again & again. But now I want to add the search to a Scheduled report. How can I achieve the same behavior in the Scheduled report. Please shred some lights. Thanks in advance!!

Thulasinathan_M · ‎08-20-2023

@gcusello Sure, Here is the sample Events, which are all of single line events. index=xxx | reverse | stats list(_raw) as raw by _time | rex field=raw "(?<Events>(Event Type.*)((\n.*)?)+Event ID: \d+)" Events: 2023-08-20 22:10:10.879 Date: 20/08/2023 2023-08-20 22:10:10.879 User: DILE\Administrator 2023-08-20 22:10:10.879 Event Type: Information 2023-08-20 22:10:10.879 Event Source: AdsmClientService 2023-08-20 22:10:10.879 Event Category: None 2023-08-20 22:10:10.879 Event ID: 4101 2023-08-20 22:10:10.879 Computer: MIKEDILE

Thulasinathan_M · ‎08-20-2023

Thanks @gcusello!! But those are Single Line Events, so I can't perform REX before stats.

Thulasinathan_M · ‎08-20-2023

Hi Splunk Experts, I'm trying to list all the events on same timestamp and trying to capture only the required lines. But I'm not getting the expected results, seems like there is no "\n" in the aggregated event eventhough it breaks into new lines. Kindly shred some lights. Thanks in advance!! I've events something like below, after aggregating them by _time: Line1 blablabla Line2 blablabla <Interested line1> <Interested line2> <Interested line3> <Ends Here> Unwanted Line blablabla Query Using: index=xxx | reverse | stats list(_raw) as raw by _time | rex field=raw "(?<Events>(\<Interested.*)((\n.*)?)+\<Ends Here\>)" Result for the Above query: <Interested line1>

Thulasinathan_M · ‎08-15-2023

There are no such differentiates, just to make clear on requirement I shared the sample xml request. The only difference we can identify is based on complete template.

Thulasinathan_M · ‎08-15-2023

Hi @ITWhisperer!! Thanks for the assistance. The Request 1 & Request 3 shares the same template, but the value passed in the tags are different, but I want to consider these two request as same, while using a stat command and expecting it to return count as '2' for request with books & genres as '1' Request 1: <?xml version="1.0"?> <catalog> <book id="bk101"> <author>Gambardella, Matthew</author> <title>XML Developer's Guide</title> <genre>Computer</genre> <price>44.95</price> <publish_date>2000-10-01</publish_date> <description>An in-depth look at creating applications with XML.</description> </book> </catalog> Request 2: <?xml version="1.0"?> <catalog> <genres code="gc101"> <genre>Romance</genre> <genre>Horror</genre> <genre>Science Fiction</genre> </genres> </catalog> Request 3: <?xml version="1.0"?> <catalog> <book id="bk111"> <author>O'Brien, Tim</author> <title>MSXML3: A Comprehensive Guide</title> <genre>Computer</genre> <price>36.95</price> <publish_date>2000-12-01</publish_date> <description>The Microsoft MSXML3 parser is covered in detail, with attention to XML DOM interfaces, XSLT processing, SAX and more.</description> </book> </catalog>

Thulasinathan_M · ‎08-15-2023

Hi Splunk Experts, I've different XML request(100+ requests) as a multi-line event. Is it possible to stat these requests and get their count. But all these request would have any values between their tags and rex-ing all these request to stat them would be a difficult task, but is there any possible way to achieve this criteria. Any suggestion would be very much helpful!!. Thanks in advance!!

Thulasinathan_M · ‎08-08-2023

Thanks @isoutamo. It's Working as expected with sample inputs. But I can't rely on below pattern because it could be anything. Only thing I could make sure is 'at' followed by path to the file(Stacktraces). ([\w\.]+:|Exception)

Thulasinathan_M · ‎08-07-2023

Thanks for the pointers, I've come-up with below config, but still it's not working and it looks bit messy. What I've done is: Line_Breaker: Broken down events based on the Timestamp/ Previous line of first matching line with 'at'/ Last matching line with 'at' BREAK_ONLY_BEFORE: Timestamp/ Previous line of first matching line with 'at' MUST_NOT_BREAK_AFTER: Previous line of first matching line with 'at' MUST_BREAK_AFTER: Last matching line with 'at' Any suggestion on what I've done wrong please. SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+)(?:(\[$\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$\])|(\[$\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$\]\s+(?!at).*)\n(?:\[$\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$\]\s+(?=at).*)|(\[$\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$\]\s+(?=at).*)\n(?:\[$\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$\]\s+(?!at).*) NO_BINARY_CHECK=true MUST_NOT_BREAK_AFTER=^(\[$\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$\]\s+(?!at).*)\n(?:\[$\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$\]\s+(?=at).*) BREAK_ONLY_BEFORE=^(\[$\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$\])|^(\[$\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$\]\s+(?!at).*)\n(?:\[$\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$\]\s+(?=at).*) MUST_BREAK_AFTER=^(\[$\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$\]\s+(?=at).*)\n(?:\[$\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$\]\s+(?!at).*)

Thulasinathan_M · ‎08-07-2023

Hi @inventsekar Yes that's correct!! I want to break each & every lines as a single line event, but if there are any logs met above condition mentioned in the post, then I want to wrap those logs as a multi-line event and this should be applicable to all files under my sourcetype.

Thulasinathan_M · ‎08-07-2023

Hi @ITWhisperer, Currently the configuration is below CHARSET=UTF-8 SHOULD_LINEMERGE=true disabled=false LINE_BREAKER=([\r\n]+) NO_BINARY_CHECK=true

Thulasinathan_M · ‎08-07-2023

Hi Splunk Experts, I want to break all lines as a single Line event [\r\n]. But if there are logs with stacktrace I want to consider them as multi-line event. I've tested below regex and it works as expected, but I'm not sure on, what are the properties I should apply them for a sourcetype. This is for an application which logs millions of event in a minute. Please assist me with an optimized solution. (.*[\n]((.*\)\])?(\s+at.*\)\n))+) Sample logs: [(2023-08-03 10:00:03)] INFO: Request completed successfully. [(2023-08-03 10:00:03)] ERROR: Request got failed. [(2023-08-03 10:00:02)] Exception in thread "main" java.lang.NullPointerException at com.example.MyClass.method1(MyClass.java:12) at com.example.MyClass.method2(MyClass.java:34) at com.example.AnotherClass.someMethod(AnotherClass.java:56) at com.example.Main.main(Main.java:23) [(2023-08-03 10:00:03)] INFO: Request Submitted successfully. [(2023-08-03 10:00:03)] INFO: Request completed successfully. [(2023-08-03 10:00:03)] WARN: Request failed unsuccessfully. [(2023-08-03 10:00:02)] java.io.FileNotFoundException: file.txt (No such file or directory) [(2023-08-03 10:00:02)] at java.base/java.io.FileInputStream.open0(Native Method) [(2023-08-03 10:00:02)] at java.base/java.io.FileInputStream.open(FileInputStream.java:219) [(2023-08-03 10:00:02)] at java.base/java.io.FileInputStream.<init>(FileInputStream.java:157) [(2023-08-03 10:00:02)] at java.base/java.io.FileInputStream.<init>(FileInputStream.java:112) [(2023-08-03 10:00:02)] at com.example.FileDemo.readFromFile(FileDemo.java:55) [(2023-08-03 10:00:02)] at com.example.Main.main(Main.java:12) [(2023-08-03 10:00:03)] INFO: Request completed successfully. [(2023-08-03 10:00:04)] DEBUG: Processing request: /api/v1/data?id=67890 [(2023-08-03 10:00:03)] WARN: Request failed unsuccessfully. java.lang.IllegalArgumentException: Invalid input: negative value not allowed [(2023-08-03 10:00:02)] at com.example.MathUtils.squareRoot(MathUtils.java:42) [(2023-08-03 10:00:02)] at com.example.Main.main(Main.java:33) [(2023-08-03 10:00:02)] ERROR: Failed to fetch data from the database. Expected First Multi-Line Event: [(2023-08-03 10:00:02)] Exception in thread "main" java.lang.NullPointerException at com.example.MyClass.method1(MyClass.java:12) at com.example.MyClass.method2(MyClass.java:34) at com.example.AnotherClass.someMethod(AnotherClass.java:56) at com.example.Main.main(Main.java:23) Expected Second Multi-Line Event: [(2023-08-03 10:00:02)] java.io.FileNotFoundException: file.txt (No such file or directory) [(2023-08-03 10:00:02)] at java.base/java.io.FileInputStream.open0(Native Method) [(2023-08-03 10:00:02)] at java.base/java.io.FileInputStream.open(FileInputStream.java:219) [(2023-08-03 10:00:02)] at java.base/java.io.FileInputStream.<init>(FileInputStream.java:157) [(2023-08-03 10:00:02)] at java.base/java.io.FileInputStream.<init>(FileInputStream.java:112) [(2023-08-03 10:00:02)] at com.example.FileDemo.readFromFile(FileDemo.java:55) [(2023-08-03 10:00:02)] at com.example.Main.main(Main.java:12) Expected Third Multi-Line Event: [(2023-08-03 10:00:03)] WARN: Request failed unsuccessfully. java.lang.IllegalArgumentException: Invalid input: negative value not allowed [(2023-08-03 10:00:02)] at com.example.MathUtils.squareRoot(MathUtils.java:42) [(2023-08-03 10:00:02)] at com.example.Main.main(Main.java:33)

Thulasinathan_M · ‎08-05-2023

Very Much Thanks to you @ITWhisperer. It worked perfectly, when I didn't add 'NullPointerException' in my main search. But the Events it searched against 2 mins window was (23,976,134) which took lot of time. If I expand the window to 15 mins. The search got aut-cancelled. 😞 Is there any other work-arounds I could do in this situation.

Thulasinathan_M · ‎08-05-2023

This is my realtime scenario. I search for a Generic exceptions like NPE, ArrayOutOfBoundExceptions, etc. My Search: index=main .*NullPointerException.* Search Results: Event 1: From host:XXX source:xxx 16:19:33 [WARNING] Failed to handle packet: java.lang.NullPointerException Event 2: From host:XXX source:xxx java.lang.NullPointerException Event 3: From host:YYY source:yyy java.lang.NullPointerException ********************************************* Results I'm expecting: Event 2: From host:XXX source:xxx 16:19:33 [WARNING] Failed to handle packet: java.lang.NullPointerException java.lang.NullPointerException Event 2: From host:XXX source:xxx java.lang.NullPointerException at com.Khorn.TerrainControl.Generator.ObjectSpawner.populate(ObjectSpawner.java:128) Event 3: From host:YYY source:yyy java.lang.NullPointerException Caused at app15a.action.CreateCustomerAction.execute(CreateCustomerAction.java:54) at ************************************************** Real Logs From host:XXX source:xxx 16:19:33 [WARNING] Failed to handle packet: java.lang.NullPointerException java.lang.NullPointerException at com.Khorn.TerrainControl.Generator.ObjectSpawner.populate(ObjectSpawner.java:128) at net.minecraft.server.ChunkProviderServer.getChunkAt(ChunkProviderServer.java:178) at net.minecraft.server.Chunk.a(Chunk.java:820) at net.minecraft.server.ChunkProviderServer.getChunkAt(ChunkProviderServer.java:96) Real Logs From host:YYY source:yyy 11:27:19,522 INFO app15a.action.CreateCustomerAction - an exception occurred! ============================== java.lang.NullPointerException Caused at app15a.action.CreateCustomerAction.execute(CreateCustomerAction.java:54) at org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:421) at org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:226) *********************************************** Tried alternative exhaustive search using below query but even this is bringing the same search result index=main | rex field=_raw "(?<Ex>(.*NullPointerException.*[\r\n].+[^\r\n]))" | where len(Ex)!=0 | table Ex

Thulasinathan_M · ‎08-05-2023

Thanks @PickleRick. May be we have a something in place to display the preceeding & following lines of events which is always correct. I don't have admittance to see how this has been done and the team has the respective privilege are not much supportive. That's why trying to find a solution by search.

Posts	98
Solutions	3
Karma Given	34
Karma Received	7
Member Since	‎02-04-2023

Online Status	Offline
Date Last Visited	‎06-14-2025 08:50 PM

Filter data from MultiValue field

Splunk Filter from Lookup

Update Macro From Search

Group Events with pattern

How to loop through times for same search

How to timewrap for today Format

How to escape all possible special characters

How to add value from a token into textbox

How to add lines of query from somewhere into sear...

How to list all the events on same timestamp and c...

Re: How to escape all possible special characters

Re: How to escape all possible special characters

Re: How to escape all possible special characters

How to escape all possible special characters

Re: How to add value from a token into textbox

Re: How to add value from a token into textbox

Re: How to add value from a token into textbox

How to add value from a token into textbox

Re: How to add lines of query from somewhere into ...

Re: Regex for multiple lines of a field value

How to add lines of query from somewhere into sear...

Re: rex lines after stats list()

Re: rex lines after stats list()

How to list all the events on same timestamp and c...

Re: How to group XML request events

Re: How to group XML request events

How to group XML request events

Re: How to parse events before indexing?

Re: How to parse events before indexing?

Re: How to parse events before indexing?

Re: How to parse events before indexing?

How to parse events before indexing?

Re: How to create a search for matching next line?

Re: How to create a search for matching next line?

Re: How to create a search for matching next line?

Join the Conversation