Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About nitesh218ss
nitesh218ss
Communicator
Member since:
03-30-2015
06-05-2020
Community Statistics
| Posts | 79 |
| Solutions | 3 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 03-30-2015 |
Activity Feed
- Got Karma for Re: LINE_BREAKER not work with if i add FIELD_DELIMITER in props.conf. 06-05-2020 12:47 AM
- Posted How store splunk result into database on All Apps and Add-ons. 05-17-2015 11:23 PM
- Tagged How store splunk result into database on All Apps and Add-ons. 05-17-2015 11:23 PM
- Posted Re: How i set date by log path address ? on Splunk Search. 05-16-2015 09:39 AM
- Posted Re: How i set date by log path address ? on Splunk Search. 05-15-2015 02:34 AM
- Posted Re: How i set date by log path address ? on Splunk Search. 05-13-2015 10:24 AM
- Posted Re: creating a _masheddate3 in datetime.xml on Splunk Search. 05-13-2015 02:30 AM
- Posted Re: How i set date by log path address ? on Splunk Search. 05-13-2015 01:18 AM
- Posted Re: Log file not have any date field but splunk auto give different different date to event i need remove date in _time field? on Splunk Search. 05-12-2015 12:17 PM
- Posted Re: Log file not have any date field but splunk auto give different different date to event i need remove date in _time field? on Splunk Search. 05-12-2015 12:17 PM
- Posted Re: Subtract two time in one event not work properly in milisecond on Splunk Search. 05-12-2015 12:14 PM
- Posted Re: How i set date by log path address ? on Splunk Search. 05-12-2015 12:11 PM
- Posted Re: Subtract two time in one event not work properly in milisecond on Splunk Search. 05-12-2015 02:38 AM
- Posted Re: How i set date by log path address ? on Splunk Search. 05-12-2015 12:47 AM
- Posted Re: Log file not have any date field but splunk auto give different different date to event i need remove date in _time field? on Splunk Search. 05-12-2015 12:44 AM
- Posted How i set date by log path address ? on Splunk Search. 05-11-2015 11:48 PM
- Posted Re: Extract date / time from source path with custom datetime.xml on Splunk Search. 05-11-2015 11:18 PM
- Posted Re: Time stamp, incorrect date for later events on Getting Data In. 05-11-2015 11:16 PM
- Posted Re: Manually configure timestamp at index time from custom datetime.xml on Getting Data In. 05-11-2015 11:09 PM
- Posted Re: Why is my datetime.xml configuration not extracting two separate timestamp formats from a single log file? on Getting Data In. 05-11-2015 10:44 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-11-2015
02:59 AM
hi i got Thanku very much for help me
my query is:
index="uk" sourcetype="ukpro2" serviceType=1 message="Received * bytes from IP*"|rename time as time1,message as Request | join type="outer" audit[search index="uk" sourcetype="ukpro2" serviceType=1 message="Deleted m_pReceivingSocket"| rename time as time2, message as Responce ] | eval itime=strptime(time1,"%H:%M:%S.%3N") | eval ptime=strptime(time2,"%H:%M:%S.%3N") | eval TimeDiff=ptime -itime |where TimeDiff > 0 | bucket _time span=5m |stats avg(TimeDiff) min(TimeDiff),max(TimeDiff) by _time
this quey working for every 5 min
but only one problem is date are not present in log file so splunk take auto date so the output is change base on date differ
... View more
05-11-2015
02:46 AM
I try but they give base on every Average of Time_diff for particular Time_diff
but TimeDiff is only time1-time2
time1 and time2 is important
TimeDiff is time take per trancation that is only in some milisecond to second
I need every 5 min of time1 they calculate Avg of TimeDiff
TimePer5_min AVg(Time_diff) Max(Time_diff) Min(Time_diff)
07:00:00.000 -07:04:59.999 1.6 1.8 1.5
07:05:00.00 - 07:09:59.999 1.5 1.7 1.4
07:00:00.000 -07:04:59.999 1.6 1.8 1.5
07:05:00.00 - 07:09:59.999 1.5 1.7 1.4
07:10:00.00 - 07:14:59.999 1.7 1.9 1.4
I try from 1 and half day but i not got solution
... View more
05-11-2015
02:09 AM
i use this also but they given 0 output because.
TimeDiff is only difference between request time and response time of transaction in other word TimeDiff is difference between sub query and main query but i want base on main time that is time1 or time2
It is possible by bucket
i try bucket time1 span=5m, bucket time2 span=5m but not any effect i got only one row
not different row of every 5 min
... View more
05-11-2015
01:54 AM
....|bucket _time span=5m I use this in many place but not effect
any small example .which i understand and learn easly
... View more
05-11-2015
12:42 AM
I create query which give total Average, min and max value in one row i need the result come in every 5 minuet Avg, Max, Min in one by one in row Like
Time_diff AVg Max Min
07:00:00.000 -07:04:59.999 1.6 1.8 1.5
07:05:00.00 - 07:09:59.999 1.5 1.7 1.4
07:10:00.00 - 07:14:59.999 1.7 1.9 1.4
My Query is
<code start>
index="uk" sourcetype="ukpro2" serviceType=1 message="Received * bytes from IP*"|rename time as time1,message as Request | join type="outer" audit[search index="uk" sourcetype="ukpro2" serviceType=1 message="Deleted m_pReceivingSocket"| rename time as time2, message as Responce ] |eventstats latest(time1) as lat,earliest(time2) as ear| eval itime=strptime(time1,"%H:%M:%S.%3N") | eval ptime=strptime(time2,"%H:%M:%S.%3N") | eval TimeDiff=ptime -itime |where TimeDiff > 0 |stats avg(TimeDiff) as AVG, max(TimeDiff) as MAX, min(TimeDiff) as Min
<code end>
Please help in this problem
... View more
05-08-2015
11:08 AM
thanks for reply
... View more
05-08-2015
11:06 AM
I use append but they not given correct result
value of audit are present in both search sub search and main search because audit no is similar for one transaction that message "Received * bytes from IP*" for start transaction and message "Deleted m_pReceivingSocket" for end transaction
so audit value are present every time if audit value are not equal in both side they not count because of join
... View more
05-08-2015
10:54 AM
no english persion present here.
i want make query with out subquery if possible:
Result contain this fields:
Average TimeDiff, Min TimeDiff, Max TimeDiff , Total request means the message count which is equal to "Received bytes from IP" and total Responce count means the message which is "Deleted m_pReceivingSocket"
this result come if audit no is equal
Copy past this link in new browser in this i write one more question related to this: http://answers.splunk.com/answers/233225/stats-count-not-work-in-sub-query.html
... View more
05-08-2015
05:58 AM
But i want count the sub query event but i fail because when i use ...| stats count as res in sub query they not work i post this question please reply that answer if possible
http://answers.splunk.com/answers/233225/stats-count-not-work-in-sub-query.html
... View more
05-08-2015
05:52 AM
sorry my english is bad that y you not understand.
index="uk" sourcetype="ukpro2" serviceType=1 message="Received * bytes from IP*"|rename time as time1,message as Request | join type="outer" audit[search index="uk" sourcetype="ukpro2" serviceType=1 message="Deleted m_pReceivingSocket"| rename time as time2, message as Responce ]| eval itime=strptime(time1,"%H:%M:%S.%3N") | eval ptime=strptime(time2,"%H:%M:%S.%3N") | eval TimeDiff=ptime -itime |where TimeDiff > 0 |table time2 time1 TimeDiff audit Request Responce |stats avg(TimeDiff) as AVG, max(TimeDiff) as MAX, min(TimeDiff) as Min
In this query if you see table time2 time1 TimeDiff audit Request Responce
this way i able to see message (Request or Responce converted name) in result ?
With your query this is possible ? if not then No problem
... View more
05-08-2015
04:49 AM
when i use head 20 in sub query they give 20 result, when i use head 20 in main query they give 20 result and when i use head 20 in bot they give 19 result .Result is correct
index="uk" sourcetype="ukpro2" serviceType=1 message="Received * bytes from IP*"|rename time as time1,message as Request |head 20 | join type="outer" audit[search index="uk" sourcetype="ukpro2" serviceType=1 message="Deleted m_pReceivingSocket"| rename time as time2, message as Responce |head 20]| eval itime=strptime(time1,"%H:%M:%S.%3N") | eval ptime=strptime(time2,"%H:%M:%S.%3N") | eval TimeDiff=ptime -itime |where TimeDiff > 0 |table time2 time1 TimeDiff audit Request Responce |stats avg(TimeDiff) as AVG, max(TimeDiff) as MAX, min(TimeDiff) as Min
... View more
05-07-2015
10:00 PM
I create a query which have sub query i want total number of event on sub query but they show blank result
My Query
index="uk" sourcetype="ukpro" serviceType=1 message="Received * bytes from IP*"
| rename time as time1,message as Request
| join audit [search index="uk" sourcetype="ukpro" serviceType=1 message="Deleted m_pReceivingSocket"
| rename time as time2, message as Responce
| stats count as req]
| eval itime=strptime(time1,"%H:%M:%S.%3N")
| eval ptime=strptime(time2,"%H:%M:%S.%3N")
| eval TimeDiff=ptime -itime
| table time2 time1 TimeDiff audit Request Responce
| stats avg(TimeDiff) as AVG, max(TimeDiff) as MAX, min(TimeDiff) as Min,count(Responce)
If you see in sub query last i added
.....| stats count as req
which not counting
i use eventstats but they also not work
How i count sub query event
... View more
05-07-2015
09:49 PM
when i select time like 7:10:00.000 to 7:30:00.000 then they not show result because the date part in not same date which auto provided by splunk
... View more
05-07-2015
05:45 AM
Hi
I have log file which create every 1 hr so they not have date field but splunk Automatically provide different date to every event
So when i use time search betwwen some specific time. The search fail due to different date auto provide by splunk.
I need to give one date to every event or remove date field so i able to search particular time.
My log file demo:
07:33:41.571|0071540|1|49| |O|Created send socket [447.0.0.1:1618]
07:33:41.571|0071540|1|49| |O|Sending 319 byte request to Handler
Please give any solution
... View more
05-06-2015
10:19 PM
Thankyou for answer
In last query which you given they give result correctly but time is not subtracting
But i got new way to join event thankyou for this idea
But i want both event message part time as request and responce so with you query how i do this
for this resion i create this query
index="uk" sourcetype="ukpro" serviceType=1 message="Received * bytes from IP*" | rename time as time1*,message as Request* | join audit [search index="uk" sourcetype="ukpro" serviceType=1 message="Deleted m_pReceivingSocket" | rename time as time2, message as Responce]| eval itime=strptime(time1,"%H:%M:%S.%3N") | eval ptime=strptime(time2,"%H:%M:%S.%3N") | eval TimeDiff=ptime -itime| table time2 time1 TimeDiff audit Request Responce
In upper query i rename the message in sub query and main query and after that i use to show message part as different field
I ask this question because your query processing time fast i thing
Thankyou
... View more
05-06-2015
10:16 PM
Thankyou very much now they subtract correctly
... View more
05-06-2015
06:49 AM
hi try to subtract 2 time but some are subtract some show blank
my time format is 07:33:41.556
I below i write 2 time for subtract and answer also by splunk
07:33:41.556-07:33:39.337 =8338.000000
I also write 2 more time which result is blank in splunk
07:33:40.493 - 07:33:39.649 = blank(No result) why this happening what is solution? my query
index="uk" sourcetype="ukpro" serviceType=1 message="Received * bytes from IP*" | rename time as time1,message as Request | join audit [search index="uk" sourcetype="ukpro" serviceType=1 message="Deleted m_pReceivingSocket" | rename time as time2, message as Responce]| eval itime=strptime(time1,"%H:%M:%S.%z") | eval ptime=strptime(time2,"%H:%M:%S.%z") | eval TimeDiff=(ptime -itime)| table time2 time1 TimeDiff audit
... View more
05-06-2015
04:14 AM
i use this way they run but in result how i get in result they show field result and count(audit) only not show sub query count
my query is:
| eval ll=substr(message,0,18) | where ll="getLogMsg returned" | rex field=message "^71^+(?<myAp>[^^]+)^" | eval result=if(myAp = 00,"sucess","fail") | join audit [search index="uk" sourcetype="uk18" serviceType=1 | dedup audit|fields + audit | eventstats count as kk ] |stats count(audit) by result
... View more
05-06-2015
02:28 AM
i create query in which i search unique no of values of one field and that unique value join to other query they work properly
index="uk" sourcetype="uk18" serviceType=2 | eval ll=substr(message,0,18) | where ll="getLogMsg returned" | rex field=message "^71^+(?<myAp>[^^]+)^" | eval result=if(myAp = 00,"sucess","fail") | join audit [search index="uk" sourcetype="uk18" serviceType=1 | dedup audit|fields + audit ] | stats count(audit) by result
But when i use [stats count] in subquery they not work i want to count total no of result in subquery. i want to subtract sub query count with total result
My query which not work is :
index="uk" sourcetype="uk18" serviceType=2 | eval ll=substr(message,0,18) | where ll="getLogMsg returned" | rex field=message "^71^+(?<myAp>[^^]+)^" | eval result=if(myAp = 00,"sucess","fail") | join audit [search index="uk" sourcetype="uk18" serviceType=1 | dedup audit|fields + audit | stats count as totall ] | stats count(audit) by result
if you see i add [stats count as totall] in sub query
... View more
05-05-2015
02:06 AM
1 Karma
i understand properly thanks sir
... View more
05-05-2015
12:22 AM
I create regularExp. for line break which work correctly but if i add FIELD_DELIMITER = | with that then line break not work.
props.conf
[uk1] When work properly
LINE_BREAKER = ([\r\n]+)\d{2}:\d{2}:\d{2}.\d{3}|[^|]+|[^|]+|[^|]+|[^|]+|[^|]+|
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
disabled = false
[uk12] when not work with field delimiter
FIELD_DELIMITER = |
FIELD_NAMES = timee,audit,serviceType,processId,serviceName,indicator,status1,status2,status3,status4,status5,status6
LINE_BREAKER = ([\r\n]+)\d{2}:\d{2}:\d{2}.\d{3}|[^|]+|[^|]+|[^|]+|[^|]+|[^|]+|
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Custom
disabled = false
pulldown_type = true
my log file line is start sample
13:47:17.624|1303659|2|32| |O|Creating new re
My log file sample
<start>
13:47:17.624|1303659|2|32| |O|Creating new reply object to send response
13:47:17.624|8100229|2|32| |O|1|13:47:16.202|<NUA>101008</NUA><Request>1221606590018F2F61179807908 ********************************** 5000 01 1503181346 22 826 826 10 (EMV_DATA) 10480 0601 323000 020000 E0B8C8 51DA9B2F</Request>
TT: 62 (ms) 13:47:16.249|1221606590018F2F61079807908 ********************************** 5000 1503181346 22 826 826 10 (EMV_DATA) 10480 0601 323000 020000 E0B8C8
13:47:17.609|122160659001812000 AUTH CODE:911278 0 1503 (EMV_DATA) 000800 00 1001 1234567890123451234 1002 GP15077000000BC1
13:47:17.624|<Response><Data>122160659001813002911278 10000 1 AUTH CODE:911278 0 90A437769C37E9153030 000800 00 1001 1234567890123451234 1002 GP15077000000BC1 DD2D26A9</Data><Offline>0</Offline><UTID>001303659</UTID><Client Key>43</Client Key><POSMessageFormat>1</POSMessageFormat><THOG Time>62</THOG Time><Operator Time>1360</Operator Time></Response>
13:47:17.624|8100229|2|32| |O|getLogMsg returned: [229^101008^17^ihost-uatlive^1^2^5^S^12^11^13^0018^231^0^15^D^18^22160659^21^150318^22^134600^24^TtWlS34ZjBo=^25^0^26^5000^199^5000^29^XTKueLHMJ9pDGvfSQn0xXI6sjf7niXAV^252^0119^181^1^274^1^275^0^45^43^71^00^80^79807908^82^20150318^83^134716^84^ASH001303659^23^911278^30^92^70^476173900^126^1^147^0^148^1^149^0^160^0^16^0^195^2^176^826^40^826^177^^178^22^179^10^188^^180^0^112^19Ifc1SHTID5k5lzxvfcU/E3O1GW+yWMFYHl+H9QlSALfWyz0rELv8UX7rdiLsIfTwMjR/DJPDrsKKBlNlQr4vurBvytdUbb7VvL1tk+r8o6VAXue3/3/PBxITFU6B8VlEF1ghoVwe8VVpWdI43HUKYPYVeDhPzQpqn5Efruc9OQY=^112^2110480 0601 323000 020000 E0B8C8 ^19^3^137^F2F6^151^1^150^10000^146^000800^112^2090A437769C37E9153030^112^2200 1001 1234567890123451234 1002 GP15077000000BC1^95^AUTH CODE:911278^196^1^94^0^119^0^134^0^33^0^253^5C413DD4331BA4E6436E2E96FDA471D3^107^^32^0000^]
13:47:17.624|8100229|1|81| |O|Received 360 byte response from IP Gateway
<end>
... View more
- Tags:
- field
- line-breaking
05-04-2015
11:39 PM
i give a solution of this problem please see answer 3
But at time of indexing i use LINE_BREAKER they work correctly but when i add
FIELD_DELIMITER = |
FIELD_NAMES = timee,audit,serviceType,processId,serviceName,indicator,status1,status2,status3,status4,status5,status6
the line break not work?
... View more
