About skallaje

skallaje · ‎05-10-2018

So, I have this following format for my log entries. FIELD1-FIELD2-FIELD3-FIELD4-FIELD5-FIELD6 and logs are like ... "abc"-"def"-"geh"-"hij"-"klm"-"Normal Message" "abc"-"def"-"geh"-"hij"-""-"--HUGE JAVA STACK TARCE--" The FIELDS column on the left side of the search page has all the "Selected Fields". The wide events section to the right of the fields column has the field names and the corresponding values underneath the events. But, FIELD6 is missing for the second event. I don't know why. Could it be because the field value (for that particular second event) is extremely large? (you know, Java Stack trace spread over 100 lines). How do i get it to appear for the second event?

skallaje · ‎05-07-2018

I wasn't even aware there was a "where" keyword in SPLUNK. I checked documentation for stats, eventstats, etc but couldn't find a solution to this problem. I also checked http://www.innovato.com/splunk/SQLSplunk.html, but it wasn't too helpful either. Anyway, Thank you very much, Gregg.

skallaje · ‎05-04-2018

The following command should return the minimum value and it does. source="SampleFilePERF.log" | stats min(ELAPSED_TIME_ms) When I click on the returned minimum value, it should show me just the one event (or record) that is related to the minimum value. But, it doesn't. It shows all events from the log file. I have almost exhausted the entire Splunk documentation for Search, but can't find the command that would provide me the output I am looking for. Is there a command that returns an entire event that is related to the output of an aggregate function (stats min | max) ? Responses are much appreciated.

Posts	3
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎05-04-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Missing Fields in events for specific log entries ...

Search related question

Missing Fields in events for specific log entries ...

Re: Search related question

Search related question