If I choose span=1mon, and today is 27th July. Will it calculate avg between 1st Jul to 27th July and June-1 to 30 and May 1to 31st and April 1st to 30th etc............ ? ... View more

I am choosing from last 2 years till Now. ... View more

Thanks for the response. I am bit confused whether to use ("abend") or ("#abend#") My sample logs are like this 1. fdjihfklsdfjsdhgrfgkjsdflk*abend890iofjsdfjs 2. shshffsjjfmicrosoft.abend890.erase*,hhhhfjksdzfhskjfhskdjfhsk ... View more

will it not be required to add asterisk(*) before and after abend890 in the eval match statement? ... View more

Sure @FrankVI Would you happen to know any way to automatically generate Splunk rex extraction commands by selecting what fields we want to fetch from the event? ... View more

Thank you @woodcock ... View more

In the events like the following , it won't give me the Failure Count 2018-07-02 09:18:44,761 https-nsse-nio-8663-exec-90 anonymous 558x723020x25 5lqwk7 88.128.203.123,30.118.254.78 /best/madget/1.0/login The user 'JRA3620' has FAILED authentication. Failure count equals 4 ... View more

@493669 For the event of following type. It won't give me the 'Failure Count' 2018-07-02 09:18:44,761 https-nsse-nio-8663-exec-90 anonymous 558x723020x25 5lqwk7 88.128.203.123,30.118.254.78 /best/madget/1.0/login The user 'JRA3620' has FAILED authentication. Failure count equals 4 ... View more

Thank you @knielsen ... View more

Thank you super very much. ... View more

I tried the following , sourcetype="Raccess" (host="AVOP" OR host="BVOP") date_wday!=saturday AND date_wday !=sunday makeresults | eval input=_raw | rex field=_raw "^(?<ips>\S+)\s\|\s(?<protocol>\S+)\s\|\s(?<id>i\S+)\s\|\s([^\|]+\|\s){8}(?<id_no>\S+)" | stats values(id_no) It gives errors saying Error in 'makeresults' command: This command must be the first command of a search. ... View more

Could you help me form it in a query This is how I am composing sourcetype="Raccess" (host="AVOP" OR host="BVOP") date_wday!=saturday AND date_wday !=sunday | rex "^(?\S+)\s|\s(?\S+)\s|\s(?\S+)\s|\s([^|]+|\s){8}(?\S+)" | where NOT like(id,"i%") | timechart values(id_no) This doesn't give me any result. Yes, extracting all the fields would also help me a great deal... But we just gotta make sure only to extract the fields from the events if the third field of the event starts with an 'o' Not 'i'. ... View more

It does work brilliantly. Thank you. If I may add one more thing, Now, I see two columns, agilebord and dc(user) and the agilebord number is like 2234, 6784 etc... Instead of that can I have some string appended to it , so that the agilebord column looks like this https://phun.mayhem.com/secure/SuperBoard.jspa?AgileView=2234 https://phun.mayhem.com/secure/SuperBoard.jspa?AgileView=6784 ... View more

There is something wrong with my extraction. That's why | stats command work with mine. Hence raised the question. I could use some help in extraction ... View more

Thanks for your assistance. Just wanted to confirm again, if we indeed get the results in "bytes"? IF yes, then that's totally awesome. We can get it converted to GB or MB and make it work? ... View more

could you please give an example with sample query on how to do the same with tstats ... View more

Absolutely brilliant @somesoni2 ♦ Thank you very very much. You simplified the extraction and timechart works too. ... View more

| host="yelowpark.gamers.com" source="/apps/absan/jra/logs/access_log.data" | eval headers=split(_raw,";") | eval a=mvindex(headers,1) | eval b=mvindex(headers,2) | eval b_pipe=split(b,"|") | eval b1=mvindex(b_pipe,3) | eval b_colon=split(b1,":") | eval Total_Connection=mvindex(b_colon,1) | eval c=mvindex(headers,3) | eval c_pipe=split(c,"|") | eval c1=mvindex(c_pipe,1) | eval c1_colon=split(c1,":") | eval c_target=mvindex(c1_colon,1) | eval c2=mvindex(c_pipe,2) | eval c2_colon=split(c2,":") | eval c_status=mvindex(c2_colon,1) | eval c3=mvindex(c_pipe,3) | eval c3_colon=split(c3,":") | eval jra_conn=mvindex(c3_colon,1) | eval d=mvindex(headers,4) | eval d_pipe=split(d,"|") | eval d1=mvindex(d_pipe,1) | eval d1_colon=split(d1,":") | eval d_target=mvindex(d1_colon,1) | eval d2=mvindex(d_pipe,2) | eval d2_colon=split(d2,":") | eval d_status=mvindex(d2_colon,1) | eval d3=mvindex(d_pipe,3) | eval d3_colon=split(d3,":") | eval bam_conn=mvindex(d3_colon,1) | eval e=mvindex(headers,5) | eval e_pipe=split(e,"|") | eval e1=mvindex(e_pipe,1) | eval e1_colon=split(e1,":") | eval e_target=mvindex(e1_colon,1) | eval e2=mvindex(e_pipe,2) | eval e2_colon=split(e2,":") | eval e_status=mvindex(e2_colon,1) | eval e3=mvindex(e_pipe,3) | eval e3_colon=split(e3,":") | eval bib_conn=mvindex(e3_colon,1) Sample event below: Type: VIP Status | Target: /Common/lera.mayhem.com-80-int-llb | Status: The children pool member(s) either don't have service checking enabled, or service check results are not available yet | Current Conns: ; Type: VIP Status | Target: /Common/lera.mayhem.com-334-int-llb | Status: The virtual server is available | Current Conns: ; Type: Pool Status | Target: /Common/lera.mayhem.com-334-int-llb | Status: The pool is available | Current Conns: 9069; Type: Pool Member Status | Target: 20.239.118.200:8004 | Status: Forced down | Current Conns: 0; Type: Pool Member Status | Target: 20.239.128.245:8004 | Status: Pool member is available | Current Conns: 566; Type: Pool Member Status | Target: 20.239.189.243:8334 | Status: Pool member is available | Current Conns: 223; Type: Pool Member Status | Target: 20.239.289.44:8004 | Status: Pool member is available | Current Conns: 113; Type: Pool Member Status | Target: 20.239.209.11:8004 | Status: Pool member is available | Current Conns: 334; Type: Pool Member Status | Target: 20.239.209.22:8004 | Status: Pool member is available | Current Conns: 114; ... View more