cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
dineshCool
New Member
Member since: ‎05-14-2018
‎06-05-2020
Community Statistics
Posts 4
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎05-14-2018
Activity Feed
View All

Splunk rex field extraction issue

by in Splunk Search
‎08-09-2019 03:17 AM
‎08-09-2019 03:17 AM
Hi Guys, I have to extract one field from the below log and i tried this regex in https://rubular.com/ "(?<=^4Nett\s\W\W)(\W.*)$" This regex exactly working what i am looking for. Status report: "<App name> :: <Status>" ABC_Service :: Started in 2 sec but when i try this in splunk it is not giving me the extracted field. <base query>|rex (?<Application_status><=^4Nett\s\W\W)(\W.*)$ My expected result Started in 2 sec Please give me a hint what i am missing here ... View more

Re: How to select latest events based on some cond...

by in Splunk ITSI
‎06-12-2019 02:45 AM
‎06-12-2019 02:45 AM
I have plenty of the events like this and i am not using any window for analysis. The jobs may run multiple times but it has to consider the "status". if any of the previous run in "success" then it has to take the event has success. But if there is any failure in the result set , then the result should be in "FAIL". ... View more

Re: How to select latest events based on some cond...

by in Splunk ITSI
‎06-06-2019 11:18 PM
‎06-06-2019 11:18 PM
Thanks for the response. My goal is to achieve to fetch the events status has "success" in any of the previous or latest run. but at the same time it has to consider the events has fail also. if the job ran multiple times and the status of the job remains "Fail", then the fail status should appear in the table. ... View more

How to select latest events based on some conditio...

by in Splunk ITSI
‎06-06-2019 07:21 AM
‎06-06-2019 07:21 AM
Hi Guys, Please help with this below scenario. I have events like this Now I want to take the events has a "success" status. Here I need to display the results in the same format which mentioned in the snapshot. I tried with below query but it's not giving me the correct data |<base_query> |stats earliest(status) AS earliest_state,latest(_time) latest(status) AS latest_state BY Name_Of_the_Job |eval job_status=if(earliest_state="SUCCESS","SUCCESS","FAIL") |table host, Application_name, Job_name, job_duration, _time, status Thanks in advance ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM