Hi Team, Would like to design the query for the below requirement where we wanted to capture 2 dash boards as below for the information we have as logs (refer test data in this attachment which is the sample log data) Dash board1 – To get details of the logs based on the field Thread_number and Application_MSG having APP Request (which is part of my incoming log data). This is designed already. Timestamp1 – Combination of Thread_number and Application_MSG having APP Request occurnace Timestamp2 - Combination of Thread_number and Application_MSG having APP Request next occurance and to be continued for each occurrence Dash board2 – This is a drill down dashboard from Dashboard1 which has to return the list of lines between the rows displayed in Dashboard1 Test Data : 2018-05-14 14:25:00,093 INFO STDOUT 14:25:00,093 [com.xxx] INFO - APP Request [ RequestInformation1 ] 2018-05-14 14:25:00,108 INFO com.777 Transform - Completed server response transform. Took 31 ms. 2018-05-14 14:25:10,189 INFO com.777 Listing exeuction. Took 32 ms. 2018-05-14 14:25:12,109 INFO com.777 Query processed. 2018-05-14 14:25:13,112 INFO com.777 Query processed. 2018-05-14 14:25:14,053 INFO STDOUT 14:25:00,093 [com.xxx] INFO - APP Request [ RequestInformation2 ] 2018-05-14 14:25:13,124 INFO com.777 Response processed. Fields AUDIT_TIME, LOGGING_PRIORITY, LOG_LEVEL, CONNECTION_FACTOR ,THREAD_NUMBER ,,AUDIT_DATA Regular Expression ^(?P<AUDIT_TIME>[^,]+)[^,\n]*,(?P<LOGGING_PRIORITY>\d+)\s+(?P<LOG_LEVEL>\w+)\s+(?P<CONNECTION_FACTIRY>[^ ]+)\s+(?P<THREAD_NUMBER>[^ ]+)\s+(?P<AUDIT_DATA>.+) AUDIT_TIME: 2018-05-14 14:25:00 Logging_Priority : 331 Log_Level : INFO Connection_factory : [STDOUT] Thread_Number : (http-123.123.123-800-8) AUDIT_TIME: 14:25:00,093 [com.xxx] INFO - APP Request [ RequestInformation1 ] Dashbaord1 shows 2018-05-14 14:25:00,093 INFO STDOUT 14:25:00,093 [com.xxx] INFO - APP Request [ RequestInformation1 ] 2018-05-14 14:25:14,093 INFO STDOUT 14:25:00,093 [com.xxx] INFO - APP Request [ RequestInformation2 ] Expected output in dash board2 2018-05-14 14:25:00,093 INFO STDOUT 14:25:00,093 [com.xxx] INFO - APP Request [ RequestInformation1 ] 2018-05-14 14:25:00,108 INFO com.777 Transform - Completed server response transform. Took 31 ms. 2018-05-14 14:25:10,108 INFO com.777 Listing exeuction. Took 32 ms. 2018-05-14 14:25:12,108 INFO com.777 Query processed. 2018-05-14 14:25:13,108 INFO com.777 Query processed. 2018-05-14 14:25:14,093 INFO STDOUT 14:25:00,093 [com.xxx] INFO - APP Request [ RequestInformation2 ] 2018-05-14 14:25:13,108 INFO com.777 Response processed. In the above data we have mapped THREAD_NUMBER: http-123.123.123-800-8 as value A and AUDIT_DATA: "APP Request" as value B So now I’m trying to print the below events as they are the values between the same combination values of A & B (i.e. THREAD_NUMBER: http-123.123.123-800-8 & AUDIT_DATA: "APP Request") 2018-05-14 14:25:00,093 INFO STDOUT 14:25:00,093 [com.xxx] INFO - APP Request [ RequestInformation1 ] 2018-05-14 14:25:00,108 INFO com.777 Transform - Completed server response transform. Took 31 ms. 2018-05-14 14:25:10,108 INFO com.777 Listing exeuction. Took 32 ms. 2018-05-14 14:25:12,108 INFO com.777 Query processed. 2018-05-14 14:25:13,108 INFO com.777 Query processed. ... View more

Hi Mates, i get output of a query as below, i would like to pass the output of this query to the of my code but the is not supporting the time format generated by the query so please help in changing the time format output = AUDIT_TIME="2018-06-05 21:00:02" Query : index="jboss" AUDIT_DATA="XXXXX" AND AUDIT_DATA=""XXXX8"" AUDIT_TIME>="2018-06-05 21:00:00" | table AUDIT_TIME | sort AUDIT_TIME | uniq | sort 2 AUDIT_TIME | reverse | return AUDIT_TIME i wanna pass this output value AUDIT_TIME in ... View more

Hi Team, I am trying to design a query here, i have a list of vales as below the requirement is that i wanna all the values that are in between same combination of A & B for example if "value A"="-11" & "Value B"="request" then the query should check for the same values if it finds A=-11 and B= request the loop should exit and display the O/p as below -11 request - (should display the 1st combination ) -10 bag -13 ball so can any one help me designing a query for the above case Regards, Vigneshprasanna R ... View more

Hi Team, I wanna design a Line Chart that gives me the count of request that has hit my server with time as base. Test data : 2017-08-08 22:38:24,331 INFO XYZXYZ 22:38:24,331 INFO [APP_INVOKE_MSG] APP Request aDasdADSAdsaDSADASDA asdaSD ID_01SDFBH ASDASDASDDAdASSDa //-1/NO,RULE.ID:1:1=below minimum value (0) 2017-08-08 22:38:24,331 INFO XYZXYZ 22:38:24,331 INFO [APP_INVOKE_MSG] APP Request aldisjba;sdjba;ojds;ajn;kc a;ojcn;ajc;ajobnc;ooajb;ojjaw;jbb; The above data is parsed in the below format and has brought inside the splunk Data Parsing Formate: Timestamp : 2017-08-08 Time : 22:38:24 Logging_Priority : 331 Log_Level : INFO Connection_factory : [XYZXYZ] Thread_Number : (httpXYSGHFA 10.100.1234.12-1234-81) Application_Message : 22:38:24,331 INFO [APP_INVOKE_MSG] APP Request [ ID_123SDFBH//-1/NO,RULE.ID:1:1=below minimum value (0) ] With the field "Time" in the X axis and Y axis by counting the string "Request" & "Response" in the application Message i need to draw a graph exactly as shown below please help me with the query. Regards, Vigneshprasanna R ... View more

Hi Team, I have a challenge here, i totally have no idea to design this query, Please help in doing this. Test Data : Line Number 1 => 2017-08-08 22:38:24,331 INFO XYZXYZ 22:38:24,331 INFO [APP_INVOKE_MSG] APP Request [ ID_01SDFBH//-1/NO,RULE.ID:1:1=below minimum value (0) ] Line Number 2 => 2017-08-08 22:39:45,331 WARN XYZXYZ 22:38:24,331 INFO [APP_INVOKE_MSG] APP Request [ ID_02SDFBH//-1/NO,RULE.ID:1:1=below minimum value (0) ] Line Number 3 => 2017-08-08 22:42:57,331 ERROR XYZXYZ 22:38:24,331 INFO [APP_INVOKE_MSG] [ ID_34SDFBH//-1/NO,RULE.ID:1:1=below minimum value (0) ] Line Number 4 => 2017-08-08 22:48:24,331 SEVIER XYZXYZ 22:38:24,331 INFO [APP_INVOKE_MSG] [ ID_23SDFBH//1/NO,RULE.ID:1:1=below minimum value (0) ] Line Number 5 => 2017-08-08 22:55:23,331 INFO XYZXYZ 22:38:24,331 INFO [APP_INVOKE_MSG] [ //-1/NO,RULE.ID:1:1=below minimum value (0) ] Line Number 6 => 2017-08-08 22:58:32,331 INFO XYZXYZ 22:38:24,331 INFO [APP_INVOKE_MSG] APP Request [ ID_32SDFBH//-1/NO,RULE.ID:1:1=below minimum value (0) ] Line Number 7 => 2017-08-08 23:01:42,331 ERROR XYZXYZ 22:38:24,331 INFO [APP_INVOKE_MSG] APP Request [ ID_01SDFBH//-1/NO,RULE.ID:1:1=below minimum value (0) ] Line Number 8 => 2017-08-08 22:38:34,331 INFO XYZXYZ 22:38:24,331 INFO [APP_INVOKE_MSG] APP Request [ ID_02SDFBH//-1/NO,RULE.ID:1:1=below minimum value (0) ] Line Number 9 => 2017-08-08 22:38:25,331 INFO XYZXYZ 22:38:24,331 INFO [APP_INVOKE_MSG] APP Response [ ID_23SDFBH//-1/NO,RULE.ID:1:1=below minimum value (0) ] Data Parsing Formate: Timestamp : 2017-08-08 22:38:24 Logging_Priority : 331 Log_Level : INFO Connection_factory : [XYZXYZ] Thread_Number : (httpXYSGHFA 10.100.1234.12-1234-81) Application_Message : 22:38:24,331 INFO [APP_INVOKE_MSG] APP Response [ ID_123SDFBH//-1/NO,RULE.ID:1:1=below minimum value (0) ] In the Above set of test data, i wanna write a query in the way it should meet the following needs Case 1: If we are searching for the CUS_ID = ID_01SDFBH (This id will be in the 1st line of the test data in the Application_Message field) Splunk should take the the thread number (here it should take "httpXYSGHFA 10.100.1234.12-1234-81" & "httpXYSGHFA 10.100.1234.12-1234-33") Example Using Test Data Here the splink should display the Thread Number's in line Number 1 & 7 because as the log line contain the Search test which is CUS_ID = ID_01SDFBH Case 2: When I choose the thread ID "httpXYSGHFA 10.100.1234.12-1234-81" splunk should return the log lines between the next occurrence of the (Same Thread Number)"httpXYSGHFA 10.100.1234.12-1234-81" & String "APP Request" Example Using Test Data Here the splunk should display from the Line 1 to Line 5 as the line 1 has the CUS_ID = ID_01SDFBH + "APP Request" + Thread Number="httpXYSGHFA 10.100.1234.12-1234-81", And ends at the line 5 as the line 6 has Same Threads Number "httpXYSGHFA 10.100.1234.12-1234-81" & "APP Request" ... View more