Hi , Is there any way I can simply have Plprdfinodm01 as my Source in Splunk which indicates JVM name? D:\splunk\was\vxpip-ppm01\PIprdfinodm01\messages.log D:\splunk\was\vxpip-ppm02\PIprdfinodm01\messages.log D:\splunk\was\vxpip-ppm02\PIprdfinodm01\messages.log D:\splunk\was\vxpip-ppm01\PIprdfinodm01\messages.log D:\splunk\was\vxpip-ppm02\PIprdfinodm01\messages.log D:\splunk\was\vxpip-ppm02\PIprdfinodm01\messages.log D:\splunk\was\vxpip-ppm01\PIprdfinodm01\messages.log D:\splunk\waslp\vxpip-ppm02\PIprdfinodm01\messages.log ... View more

index=xyz "The Key is not in cache the source Code:" |rex field=_raw ":(?\w+)" | stats count by imagetype However, it is giving me output as below: Imagetype Count 00 14 01 7 02 5 03 11 Instead, I was expecting below : Imagetype Count JPEG 1 TIF 05 GIF 07 Appreciate your help on this 2017-08-18T03:34:06+00:00 vxdev-pp03 [8/17/17 23:34:06:045 EDT] 0000d635 PersistenceMo I The Key is not in cache the source Code:JPEG 2017-08-18T03:14:24+00:00 vxpup-pp04 [8/17/17 23:14:24:131 EDT] 0000d61d PersistenceMo I The Key is not in cache the source Code:TIF 2017-08-18T02:10:16+00:00 vxpup-pp05 [8/17/17 22:10:16:009 EDT] 0000d4a9 PersistenceMo I The Key is not in cache the source Code:GIF 2017-08-18T03:44:06+00:00 vxdev-pp03 [8/17/17 23:34:06:045 EDT] 0000d635 PersistenceMo I The Key is not in cache the source Code:JPEG 2017-08-18T03:14:54+00:00 vxpup-pp04 [8/17/17 23:14:24:131 EDT] 0000d61d PersistenceMo I The Key is not in cache the source Code:TIF ... View more

Hi , I have below string and need to extract field after HCM5250: and before . Also, while doing search need to consider 65. Both response Code and responseMessage written on separate lines 65 updateContractTxnAccount Failed - update HCM5250:AD1218494460121708 For e.g: index=mylog "65" AND "updateContractTxnAccount Failed - update HCM5250:" |rex Not sure how to get exact rex here . Appreciate your help !! Thanks , Harish ... View more

trying to list Heapdump and javacore counts across multiple hosts Splunk search host=A OR host=B OR host=C OR host=D "JVM requested Java dump" |stats count as Java_Dump by host | appendcols [search host=A OR host=B OR host=C OR host=D] "JVM requested Heap dump"|stats count as Heap_Dump by host This one is not working for me ..Appreciate any suggestion to this Also, I tried below one .. It return values for both Java dump and Heap dump but its giving wrong count and patterns host=A OR host=B OR host=C OR host=D |stats count(eval(searchmatch("JVM requested Java dump"))) as Java_Dump count(eval(searchmatch("JVM requested Heap dump"))) as Heap_Dump by host ... View more

Hello All, Currently, I have dashboard which has time input as "Today" which lists the total count of Payments index=myindex "paymentmodule" | stats count as Payments I can add another "Time Input -2" with same search which I used above for "Time Input-1"to existing dashboard but I don't know how to make the "Time input -2" dynamic so that I can compare the total counts for any weekday with current day. For e.g. Total count for current week Wednesday v/s Total count for last week Wednesday I could not find any option to make Time Range -2 dynamic so that I need not to go and manually change values in time picker Appreciate your valuable suggestions in advance Attached dashboard design ... View more