Hi, I have logs like I want to extract the Bold string from the below logs. I used below rex but it's showing no results. can anyone help me to resolve this | rex field=_raw "[A-Z]/(?.*) - 80 OR - 443" 2017-03-29 12:25:32 W3SVC2 172.30.2.174 GET /API/BrandsForCategoryReport/BrandsByList/FIBA/RU-RU/201714 - 80 2017-03-29 11:10:52 W3SVC2 172.30.2.174 GET /API/Local/Attribute/HI-IN-DL/FICA/GTS/_13237/upos2_stmt - 80 KT\chaudharis 10.116.164.62 HTTP/1.1 Mozilla/4.0+ 2017-03-29 10:45:21 W3SVC2 172.30.2.174 POST /GUI/Local/StoreName/Update/EN-IN-DL/FIBS/GTS/_24978-03/so3_list - 80 KT\YadavKo 2017-03-29 12:19:20 W3SVC2 172.30.2.174 GET /GUI/Scripts/jquery-1.4.1.min.js - 80 KT\apten 2017-03-29 12:19:20 W3SVC2 172.30.2.174 GET /GUI/Scripts/qdb.edit-global-content.js - 80 KT\apten 2017-03-29 11:36:16 W3SVC2 172.30.2.174 GET /WUI/Content/lib/kendo/2016.2.714/css/Bootstrap/sprite.png - 443 KT\apten 2017-03-29 11:36:15 W3SVC2 172.30.2.174 GET /WUI/Content/lib/kendo/2016.2.714/css/Bootstrap/loading-image.gif - 443 KT\apten 2017-03-29 11:31:58 W3SVC2 172.30.2.174 GET /WUI/Content/lib/fontawesome/fonts/fontawesome-webfont.woff2 v=4.6.3 443 KT\HuynhH 2017-03-29 11:43:45 W3SVC2 172.30.2.174 PUT /WAPI/v4/translations/attribute/surveys/BGS/countries/IN/languages/HI/publish - 443 kt\apten 2017-03-29 11:18:37 W3SVC2 172.30.2.174 GET /WAPI/v4/translations/attribute/surveys/BGS/lists/upos2_stmt/countries/IN weekInterval.on=201713&weekInterval.off=201813 443 kt\apten Thanks in advance ... View more

Hi Team, May be you feel that this is a repetitive questio,n but I didn't get response, so I opened a new question. i want to create a funnel report in Splunk I need to join different data sources. I am getting output but not giving accurate results. I will give example that will give no confusion. I have 4 different indexes and sourcetypes with unique pid in all sources but all these sources are inter-related. I have 4 types of logs: 1. SecurityIISlog 2. Securitylog 3. WebIIS log 4. IVW log. All these 4 types of logs are for one online survey. For example, we will send one link to one person to do the survey. Once he clicks on the link, the first securityIISlog will be generated. If this person is eligible for the survey he will get a status of Accept then second Securitylog will be generated. More conditions are checked here and if still eligible he will get a status of Accept (if not, he will get status of Reject , so he will be stopped and he can’t move to 3rd and 4th level). The third WebIIS log will be generated here, also will have status of Success (any web page level issues will generate http errors like 500, 400 and he can’t move to 4th level). The fourth IVW log will be generated with the status of survey completed or Timed Out or Survey Stopped . In each type of log we have some status for this pid . I want a funnel report which will have the status of the pid from all sources in one report. If the survey is having 6 respondents and only 4 were reached till 4th level, I want 6 respondents in my output with corresponding status. I have individual searches for all these sources. From type 1 logs (securityIISlog) Search: index=iis sourcetype=iis host=ABC cs_method="GET" |stats values(Status) as Status_Tiis by _time host pid i_project Output: _time host pid i_project Status_Tiis 10-05-2016 01:05:25 ABC A khduei Accept 10-05-2016 01:10:45 ABC B khduei Accept 10-05-2016 05:05:25 ABC C khduei Reject 10-05-2016 06:15:35 ABC A neodue Accept 10-05-2016 06:15:45 ABC B neodue Accept 10-05-2016 07:20:25 ABC X khduei Accept From type 2 logs (Securitylog) Search: index=security sourcetype=security host=ABC |stats values(Status) as Status_T by _time host pid i_project Output: _time host pid i_project Status_T 10-05-2016 01:05:28 ABC A khduei Accept 10-05-2016 01:10:47 ABC B khduei Accept 10-05-2016 06:15:36 ABC A neodue Accept 10-05-2016 06:15:46 ABC B neodue Reject 10-05-2016 07:20:27 ABC X khduei Accept Type 3 logs (Web IIS log) Search: index=iis sourcetype=iis host=xyz |stats values(sc_status) as IIS_Status by _time host pid i_project Output: _time host pid i_project IIS_Status 10-05-2016 01:05:29 XYZ A khduei Success 10-05-2016 01:10:46 XYZ B khduei Success 10-05-2016 06:15:38 XYZ A neodue Success 10-05-2016 07:20:29 XYZ X khduei Success In Type 4 logs (IVW log) Search: index=ibm sourcetype=ivw host=IJK |stats values(Status) as IVW_Status by _time host respID project_name Output: _time host pid Project IVW_Status 10-05-2016 01:06:31 XYZ A khduei completed 10-05-2016 01:12:15 XYZ B khduei completed 10-05-2016 06:17:50 XYZ A neodue Survey stopped 10-05-2016 07:45:35 XYZ X khduei completed I am using the search below to merge the above outputs in one report; I am getting some results, but it’s not giving all results: index=iis sourcetype=iis host=ABC cs_method="GET" |eval mytime=strftime(_time, "%d%m%Y %H:%M:%S") |stats values(Status) as Status_Tiis by mytime pid i_project|table mytime i_project pid Status_Tiis|join type=outer [search index=security sourcetype= security host=ABC |eval mytime=strftime(_time, "%d%m%Y %H:%M:%S")|where isnotnull(i_project) |stats list(Status) as Status_T by mytime i_project pid |table mytime host i_project pid Status_T|join type=outer[search index=iis sourcetype=iis host=XYZ cs_method=GET |eval mytime=strftime(_time,"%d%m%Y %H:%M:%S") | stats values(sc_status) as Status_Wiis by mytime i_project pid ]]|table mytime host i_project pid Status_Tiis Status_throttler Status_Wiis I want an output like: _time pid i_project Status_Tiis Status_T IIS_Status IVW_Status Duration (Sec) 10-05-2016 01:05:25 A khduei Accept Accept Success Completed 91 10-05-2016 01:10:45 B khduei Accept Accept Success Completed 89 10-05-2016 05:05:25 C khduei Reject 10-05-2016 06:15:35 A neodue Accept Accept Success Survey stopped 147 10-05-2016 06:15:45 B neodue Accept Reject 1 10-05-2016 07:20:25 X khduei Accept Accept Success Completed 1500 ... View more

Hi team, I am unable to post a question, when i am posting a question getting 500 error Thanks ... View more

Hi, I have 3 different sources. I want to merge splunk search data with another data of 2 different csv files using inputlookup. From all 3 different sources p_name is the common field. But csv files having more number of records (this file is having duplicate project names) than IVW logs. I want to lookup with csv file for latest values. Example: from IVW logs, I got output like p_name; respondents; host A 20 X B 25 Y C 5 Z D 12 W E 6 V From A-N.csv, I have fileds like p_code; O_Status; O_Server; Contact; SVer DateTime A; Pass; AB1; abc@f ; 2; 23/01/2016 06:30:20 A; Pass; AB1; abc@f ; 2; 22/02/2016 05:10:20 A; fail; AB1; abc@f ; 2; 13/03/2016 08:30:20 A; Pass; AB1; abc@f ; 2; 05/03/2016 07:20:20 A; Pass; AB1; abc@f ; 2; 06/03/2016 05:30:20 A; Pass; AB1; abc@f ; 2; 11/03/2016 05:30:20 C; fail; NA Not found NA 15/01/2016 05:30:20 C; Pass; AB1; abc@f ; 2; 05/02/2016 05:30:20 C; Pass; AB1; abc@f ; 2; 15/02/2016 05:30:20 C; fail; AB1; abc@f ; 2; 02/03/2016 05:30:20 C; fail; AB1; abc@f ; 2; 13/03/2016 05:30:20 B; Pass; AB1; abc@f ; 2; 12/01/2016 05:30:20 B; Pass; AB1; abc@f ; 2; 11/02/2016 05:30:20 B; Pass; AB1; abc@f ; 2; 10/02/2016 05:30:20 B; Pass; AB1; abc@f ; 2; 25/02/2016 05:30:20 B; Pass; AB1; abc@f ; 2; 02/03/2016 05:30:20 B; Pass; AB1; abc@f ; 2; 07/03/2016 05:30:20 B; pass; AB1; abc@f ; 2; 12/03/2016 05:30:20 H; Pass; AB1; abc@f ; 2; 10/02/2016 05:30:20 H; Pass; AB1; abc@f ; 2; 25/02/2016 05:30:20 H; Pass; AB1; abc@f ; 2; 02/03/2016 05:30:20 H; Pass; AB1; abc@f ; 2; 07/03/2016 05:30:20 M; fail; AB1; abc@f ; 2; 12/03/2016 05:30:20 M; Pass; AB1; abc@f ; 2; 02/03/2016 05:30:20 M; Pass; AB1; abc@f ; 2; 07/03/2016 05:30:20 M; fail; AB1; abc@f ; 2; 12/03/2016 05:30:20 M; Pass; AB1; abc@f ; 2; 10/02/2016 05:30:20 From D1.csv, I have fields like Project; CCoun; CO1; Contacts A; ABC ; AB ; AB@g B; XYZ ; CD ; BC@g C; LMN ; EF ; CD@g D; PQR ; GH ; EF@g E; STU ; YZ ; GH@g I want my output like p_name; respondents; host; CCoun; CO1; Contancts; O_status O_Server SVer A ; 20 ; X; ABC ; AB ; AB@g ; Pass ; AB1 2 B ; 25 ; Y XYZ; CD ; BC@g ; pass ; AB1 2 C ; 5 ; Z LMN ; EF ; CD@g fail ; AB1 2 D ; 12 ; W PQR ; GH; EF@g E ; 6 ; V STU ; YZ ; GH@g Below query is giving results but in some places there is data in A-N.csv but not showing in output. Can any one help me to do this. there is duplicate project names in A-N.csv, but when I am mapping with ivw data it has to show latest values based on the date in A-N.csv index=ibm sourcetype=ivw host=ABC |eval p_name=upper(p_name) |chart distinct_count(respondentID) as respondents, values(host) as "host", count as Entries, |join max=0 type=outer "p_name" [|inputlookup A-N.csv |rename PCode as p_name|values(O_Server) as O_Server values(O_Status) as O_Status values(SVer) as SVer by p_name] |join max=0 type=outer "p_name" [|inputlookup D1.csv |rename project as p_name|stats values(CCoun) as CCoun values(CO1) as CO1 values(Contacts) as Contacts by p_name ] Thanks in advance ... View more