I would want to know if I can create a form as below : Time : 23/01 No of Events : 57 Exceptions : 400 - site not found ABCD : take the next action EFG : refer the instructions guide The left side should remain constant and the right side gets populated with the data from Splunk on the occurrence of a particular event. ... View more

Hi, I have a request where in 1.I will have to perform a search to get value A,B and C (where B is the values of the field that i created using regex) 2.Based on the values of B -> I will have to perform another search in completely different index and get the values of E and F 3.And also based on the values of B -> I will have to perform another search in completely different index and get the values of G and H 4.Finally i should have table with A B C E F G H I tried using join concept but the common field between 1st and 2nd search is B and B is the field that i extracted using rex. I'm not because of that reason it is working or not,I'm getting ) results. Kindly help! Thanks! ... View more

I want to extract the Autosys_Job from the below log snippet and so used the below rex. Log Snippet : Query : rex "(?:(\nAutosys_Job:)?\s(?\S+))" the results are not as expected Expected Result : event_1 tsx1_d Kindly help ... View more

Please help me in writing the regular expression for the below: 2017-11-17 14:20:03 DueDate="11/17/2017", Identifier="12244", ID Year="1887", ID name="Tool-Based", Pickup Contact Phone#="(123) 123-1234" I wanted to write regular expressions for all the values that are within the Quotes. Thanks in advance! ... View more

Hello Seniors, I have the below log snippet 11/7/17 8:37:25 PM [INFO] |Send|staring to send|seq id "234567" 11/7/17 8:37:25 PM [INFO] |receive |staring to receive |seq id "1234567" 11/7/17 8:30:27 PM [INFO] |receive |staring to receive |seq id "890123" 11/7/17 8:30:27 PM [INFO] |receive |failed:javaException 11/7/17 8:37:25 PM [INFO] |Send|staring to send|seq id "453789" 11/7/17 8:28:30 PM [INFO] |receive |staring to receive |seq id "567890" 11/7/17 8:20:27 PM [INFO] |receive |staring to receive |seq id "123890" 11/7/17 8:20:27 PM [INFO] |receive |failed:javaException I wanted my results to have the information of the seq ids that are received.So i use the Keyword "receive" But i do not want my result to have seq ids that are failed so my search should first look for the keyword "recieve" and then if is "not" failed in the next event it should be displayed. We just have the clue that the time the seq id start to recieve is same that of the time that it failed. eg : 11/7/17 8:30:27 PM [INFO] |receive |staring to receive |seq id "890123" 11/7/17 8:30:27 PM [INFO] |receive |failed:javaException Please help me with this. Thanks in advance!! ... View more

Hi, Please help me with the below : I wanted to write a search query where 1.the query should find the keyword "SA.service.com" 2.if found should search the keyword "Connection reset error (of different event) 3. If found should check the time difference between the events and if the time diff is less and equal to 1 min it should output the event ... View more