Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About markthompson
markthompson
Builder
Member since:
09-29-2014
06-05-2020
Community Statistics
| Posts | 243 |
| Solutions | 17 |
| Karma Given | 67 |
| Karma Received | 68 |
| Member Since | 09-29-2014 |
Activity Feed
- Got Karma for Re: Why am I getting error "The license signature is not a base64-encoded string" trying to add my license in Splunk 6.2?. 01-06-2025 02:27 AM
- Got Karma for How to round stats average to 2 decimal places?. 09-13-2023 03:01 PM
- Got Karma for Re: Can an input be enabled or disabled based on another input?. 03-10-2022 02:39 AM
- Got Karma for How to round stats average to 2 decimal places?. 12-23-2020 01:33 PM
- Got Karma for Re: How to make a drop-down form wider?. 06-05-2020 12:48 AM
- Karma Real time search, how to check if event doesn't exist and return something if it doesn't. for DavidHourani. 06-05-2020 12:47 AM
- Karma Re: Is there a URL Prefix variable in Simple XML? for LukeMurphey. 06-05-2020 12:47 AM
- Karma Re: How can I search and return only the first occurrence of a string? for musskopf. 06-05-2020 12:47 AM
- Karma Can I create a new field for each value contained in an existing field? for mrfredman. 06-05-2020 12:47 AM
- Karma How to search count trends by displaying a 3 column table with source name, count (last 10 min) and count (now)? for vikas_gopal. 06-05-2020 12:47 AM
- Karma Output first event and last event. for ferza. 06-05-2020 12:47 AM
- Karma How to search Splunk indexes' event count for the last one hour including zero counts? for dhavamanis. 06-05-2020 12:47 AM
- Karma Date not parsed if the hour is 24 for reggie_123. 06-05-2020 12:47 AM
- Karma Splunk Time Based Retention for nspatel. 06-05-2020 12:47 AM
- Karma How to edit my inputlookup subsearch to return field values from the csv only if the values were not found? for TobiasBoone. 06-05-2020 12:47 AM
- Karma Re: How to setup an alert if any index size goes over 90%? for MuS. 06-05-2020 12:47 AM
- Karma Re: Where can I find a complete list of data source types that can be indexed in Splunk? for MarioM. 06-05-2020 12:47 AM
- Karma Monitoring Active Directory groups, is it possible to send an email alert to the individual who was added or removed from the group? for 8i5. 06-05-2020 12:47 AM
- Karma Re: How do i file a Splunk Support Case/ contact Splunk Support? for vhallan_splunk. 06-05-2020 12:47 AM
- Karma Re: Using splunk to create and view table metadata for aweitzman. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 4 | |||
| 2 |
02-18-2015
01:45 AM
Hi Alastair,
You should use the following regex for your field due to the fact that IP's can be 3 digit.
rex field=fieldname "\[http\:\/\/[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\:[0-9]+\/(?<WS>\S+)*\]"
The + quantifier in essence says Any amount of any number in the range of 0 - 9
This should work, I haven't had a chance to test it, but I'm pretty sure it would work.
... View more
02-18-2015
01:23 AM
If you want to display it as a table, simply use the table command.
... View more
02-17-2015
01:03 AM
1 Karma
Hello,
I wish to create a new sourcetype in props.conf that uses the linebreak properties such as :
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE =
But I'm not sure what to put for the regex of BREAK_ONLY_BEFORE , does it need to be the whole line? & Does it need any capturing groups?
Also, I have a transaction command that works, but I could possibly uses that instead of props.conf, but I want to make it so that we don't have to run the transaction in all searches, any ideas?
Thanks
... View more
02-16-2015
07:00 AM
I have found a solution.
The solution I encountered is to create a new sourcetype and use the "SHOULD_LINEMERGE" boolean attribute with the property of BREAK_ONLY_BEFORE set with the regex of where the new statements should start.
Hope this helps
... View more
02-16-2015
05:39 AM
1 Karma
Hello,
I'm using a transaction command and what I want to do is find the next event that has the format "{DATE} INFO"
and then use the event previous to the found event.
Any ideas?
For example, endswith="{SEARCH}-1"
... View more
- Tags:
- regex
- transaction
02-11-2015
05:09 AM
Hi mzorzi,
Thanks for your response.
I used eventstats but I also wanted to get values from the search and table them as well.
Do you know how?
... View more
02-11-2015
04:50 AM
4 Karma
Hello,
I have a search that tables certain values from my data fields, although i wish to create a new field on all events called Maximum that gets the latest value of a field called max and another called min
... View more
02-11-2015
04:48 AM
Hi Luxiaobin, please mark this as an answer if it's the correct comments. It appears that I was correct and if you're going to be storing values as times, I'd be tempted to say do it as different fields, dob_day, dob_month, dob_year.
Something along those lines
... View more
02-10-2015
04:49 AM
Hi MuS,
Thanks for that, so would it just be chart maxSpotColor = ??
Then is it a hex value, or how should it be displayed?
... View more
02-10-2015
04:40 AM
1 Karma
To be honest, Epoch itself by definition is the time in seconds since 1st january 1970.... So how can it be a valid epoch time if it's negative value?
I don't think it would actually work.
... View more
02-10-2015
04:36 AM
2 Karma
Hello,
I'd like to put an extra point on top of the highest and lowest values on a line graph, has anyone got any suggestions?
... View more
01-08-2015
05:36 AM
Hi fdi01,
We've tried this but it's not really working as we do other stuff above. Any other ideas?
... View more
01-08-2015
05:26 AM
Hi FtizWittwer, Don't suppose you know anything about eventstats.
http://answers.splunk.com/answers/208180/eventstats-count-function.html
... View more
01-08-2015
05:26 AM
Hi Tom,
We cannot use the stats as we want to table it later on, so we would need to use some sort of other combination.
Any ideas?
... View more
01-08-2015
04:57 AM
1 Karma
Hello,
I'm looking to use the eventstats function to count the amount of times the word Error occurs in my event.
Can anyone help as it doesn't appear to work ?
... View more
01-08-2015
04:31 AM
Hi FritzWittwer,
Thanks for that, I've changed the 1 to a 0 as they should not receive any penaltypoints for finishing the job at the right time.
I'll mark it as the answer now, but first would you mind converting your comment to an answer?
... View more
01-08-2015
04:05 AM
It also appears to error with "Unbalanced Quotes", can you use "event" as a field? Also, Could you explain the match(field, "."End Program." as it seems to me you're searching for "End Program" as opposed to End Program
... View more
01-08-2015
03:58 AM
Hi FritzWittwer,
Unfortunately, the "End Program" isn't in a field, it's in the content of the Event.
Thanks for the quick response.
... View more
01-08-2015
02:59 AM
1 Karma
Hello,
We have a nested IF structure and we want to use it to assign a value to a field called PenaltyPoints1
Firstly it checks to see if the current time meets the required minimum time, if that's true then it should search for the phrase "End Program" and if it finds it, PenaltyPoints1 should be set a value of 0, if it cannot find it, then it should be assigned a value of 100.
Thanks
... View more
01-07-2015
07:18 AM
I have solved this using the eventstats command, example below:
index="{INDEX}" host={HOST} |
transaction startswith="{STARTSWITH}" endswith="{ENDSWITH}" |
eval StartTime=_time |
eventstats max(StartTime) as max |
where max=StartTime
This will select the latest event only.
... View more
01-06-2015
12:30 AM
Hi Martin, thats not particularly what we're looking for, we are using rangemaps to display traffic lights of the current status, and if it's warning but is succeeding after retry it should go amber, if its failing altogether, red, and if successful then green.
... View more
01-05-2015
12:23 AM
Hey Martin,
it will be {Timestamp}: Error - {Error type}
success will be something like The run has been completed successfully.
... View more
01-02-2015
12:58 AM
1 Karma
Hello,
Well we have a job that runs and produces log files that runs and if it fails, it retries up to 3x.
How would we get splunk to take the latest value for that day of the log file so we can detect whether or not it has failed overall or not.
Thanks
... View more
12-19-2014
12:52 AM
1 Karma
Hello,
I'm trying to create a sparkline that counts the amount of errors on a daily basis, using the keyword "Error", and then putting that onto a sparkline.
Please can you provide assistance.
index=my_index host=my_host "Error" | chart count sparkline(count, 1h) as trend by host | sort -count
Thanks
... View more
11-05-2014
05:34 AM
Can you explain what this will represent? Problem is I'm waiting for approval for me to actually go ahead and start it.... So its creating the _time variable which is used by timechart, and you're averaging duration? and max and min do what? and I want this to be per day, so it shows duration on a period of , e.g. a month, where we can see that the system is getting slower or faster.
... View more
