Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About kotig
kotig
Path Finder
Member since:
09-04-2015
07-07-2020
Community Statistics
| Posts | 26 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 2 |
| Member Since | 09-04-2015 |
Activity Feed
- Posted Re: extract values from a json like string on Splunk Search. 07-06-2020 06:05 PM
- Posted Re: extract values from a json like string on Splunk Search. 07-06-2020 05:39 PM
- Posted Re: extract values from a json like string on Splunk Search. 07-06-2020 12:31 PM
- Posted How to extract values from a JSON like string? on Splunk Search. 07-06-2020 10:46 AM
- Got Karma for How to extract fields from JSON data in Splunk?. 06-05-2020 12:47 AM
- Got Karma for How to extract fields from JSON data in Splunk?. 06-05-2020 12:47 AM
- Posted Re: How to extract fields from my string logs on Splunk Search. 02-22-2020 07:52 PM
- Posted How to extract fields from my string logs on Splunk Search. 02-22-2020 10:18 AM
- Tagged How to extract fields from my string logs on Splunk Search. 02-22-2020 10:18 AM
- Tagged How to extract fields from my string logs on Splunk Search. 02-22-2020 10:18 AM
- Posted Re: Why do I see no results when I run "index=_introspection host=hostname" search? on Security. 03-15-2017 02:58 PM
- Posted Why do I see no results when I run "index=_introspection host=hostname" search? on Security. 03-15-2017 12:49 PM
- Tagged Why do I see no results when I run "index=_introspection host=hostname" search? on Security. 03-15-2017 12:49 PM
- Posted Re: Why is my alert not triggered even though there are results that meet the criteria? on Splunk Search. 11-03-2016 09:09 AM
- Posted Re: Why is my alert not triggered even though there are results that meet the criteria? on Splunk Search. 11-02-2016 10:50 AM
- Posted Re: Why is my alert not triggered even though there are results that meet the criteria? on Splunk Search. 11-02-2016 09:15 AM
- Posted Why is my alert not triggered even though there are results that meet the criteria? on Splunk Search. 11-02-2016 08:46 AM
- Tagged Why is my alert not triggered even though there are results that meet the criteria? on Splunk Search. 11-02-2016 08:46 AM
- Tagged Why is my alert not triggered even though there are results that meet the criteria? on Splunk Search. 11-02-2016 08:46 AM
- Tagged Why is my alert not triggered even though there are results that meet the criteria? on Splunk Search. 11-02-2016 08:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 |
07-06-2020
05:39 PM
index=mysearchIndex | table message | rex "status \{\nvalue: \"(?<status>\w+)" | table status Here - message contains contains the string like below: message ----------- mydata { name { value: "1111" } id { value: "2020-07-02 15:49:00" } status { value: "Active" } }
... View more
07-06-2020
12:31 PM
yea i tried the rex. But it did not work. What i did was search splunk and put them into a table and then tried the rex as mentioned above but i had no luck.
... View more
07-06-2020
10:46 AM
I am having data like this in my Splunk and I wanted to extract the value of status which is Active. How can I do it when this is not a valid JSON string? mydata {
name {
value: "1111"
}
id {
value: "2020-07-02 15:49:00"
}
status {
value: "Active"
}
}
Any help is appreciated.
... View more
Labels
- Labels:
-
eval
-
field extraction
-
fields
-
stats
-
table
02-22-2020
07:52 PM
Yea tried this one unfortunately i am getting empty result. Thank you for help..
... View more
02-22-2020
10:18 AM
I have something like below logged in as a message.
How can i replace "This is my logfile ** ->" with empty and then how to extract name, startdate, dept, enddate, status, id and get the values.
This is my logfile ** ->
myfulljson {
name {
value: "Test"
}
startdate {
value: "2020-02-21"
}
dept {
value: 110
}
enddate {
value: "20200220"
}
status {
value: "finish"
}
id {
value: "1234"
}
}
... View more
03-15-2017
02:58 PM
Appreciate your help on responding to my question. But as I am pretty new to this, I am not clear on what does it mean by MC. I am not sure if that was done by our Admins. I am not sure if I am an admin. Is there any other way to find out the disk usage other than the introspection?
... View more
03-15-2017
12:49 PM
I am trying to get the data from the disk_objects.log file running the search: index=_introspection host=hostname but nothing is returned. Can someone help?
Is there anything that need to be done so that we can search on the _introspection index?
Is the _introspection index available for the Linux boxes as well?
Thanks
Koti
... View more
11-03-2016
09:09 AM
Thank you, appreciate your help on trying to help me. My alert is fixed now. I had a false alarm. Thanks everyone for your inputs.
... View more
11-02-2016
10:50 AM
Sure thank you will try that option.
... View more
11-02-2016
09:15 AM
Yes, i am getting value for the day it did not trigger.
... View more
11-02-2016
08:46 AM
Hi All,
We have a search which checks for a total count of failures in system in the last 24 hours:
index=mydata earliest=-24h| stats list(Summary) as "Summary", count(Summary) as SummaryCount
when a specific failures occur, the SummaryCount has a value of 1 or more than one.
Based on that we have created an alert to trigger with custom trigger condition:
search SummaryCount>=1 and AlertType =Scheduled and is scheduled to run every day, one time at 1 am.
and the Action Options, set was "Once"
Every time we run our search we get a result, so i was expecting there will be 1 alert everyday until the SummaryCount value is returned. But i got the alert only on 1 day and later it does not send any alert emails.
Can you please help? This is really urgent.
Thanks
Koti
... View more
10-27-2016
09:15 AM
I tried the same query but still it does not give the greater values. I tried the other option suggested by other splunk user and adding the below after what you gave.
|stats list(ElapsTime) as ElapsTime, list(above_average) as above_average values(AVGResponse) as AVGResponse by sPath
Thank you for your help
Thanks
Koti
... View more
10-27-2016
09:03 AM
Thanks that query worked for me.
... View more
10-27-2016
09:00 AM
that is the query i am using. My data is coming from a json and i did extract my fields out of json and did that rex and stuff and then extracted the fields i needed for my calculations
... View more
10-27-2016
08:59 AM
index=mysource earliest =-15m|rex field=_raw "(?msi)(?{.+}$)" | spath input=json_field | rename s.Path as sPath,s.pElapsedTime as ElapsedTime|eval ElapsedTimeinSecs=(ElapsedTime/1000)|where isnotnull(ElapsedTimeinSecs)| stats list(ElapsedTimeinSecs) as ElapsTime, avg(ElapsedTimeinSecs) as AVGResponse by sPath|mvexpand ElapsedTimeinSecs|eval GreaterThankAvg=if(ElapsTime>AVGResponse,ElapsTime,null())
... View more
10-27-2016
08:46 AM
And to add it is a multivalued filed
user field value is 1 and corresponding values of marks filed are 1,2,3,4,5
... View more
10-27-2016
08:43 AM
I tried the same way but the response i get is always it gives me null() even though there are value which are greater like 4,5
... View more
10-27-2016
08:11 AM
Here is my situation. I have written a search to get a list of values per user and I did an average of the values as average. Now I wanted to compare the average I received with the list of values where I got the average and display which are more than the average.
Test Data Sample:
user Marks Average(marks)
1 1 3
2
3
4
5
Now I want to display in another column where marks>average(marks) for each user. In this example, user1 has 4 and 5 to be displayed in my search.
... View more
05-19-2016
01:47 PM
Our application has CSV log files and the CSV is indexed in Splunk, but our CSV does not have any column headers. How do I build a search to read the below data and create field names myself with a search?
Below is our Test Data in the CSV file:
Tester, test, testing
coder, code, coding
manger, lead, leader
I wanted to create a table with field1, field2, field3 where the data from each column goes correctly into each field.
... View more
03-03-2016
12:27 PM
This worked. Thank you for your inputs.
... View more
02-18-2016
05:04 PM
i am specifying the time frame as earliest=-3d, below is how my query looks..
index=logdatafile earliest=-3d | rex field=_raw "(?msi)(?\{.+\}$)" | spath input=json_field | table success.successcode,success.path,fault.errorcode,fault.path,fault.errorStatusCode | rename success.successcode as ResponseCode | rename fault.errorcode as ResponseCode|rename fault.errorStatusCode as ResponseCode| rename success.path as Path | rename fault.path as Path|where isnotnull(ResponseCode)| chart count by ResponseCode,Path
... View more
02-18-2016
03:07 PM
We have data like this:
TestPath 200 202 500 302
/test/v1 51 0 0 0
/test/v1/p1/test1/test 0 1 0 0
/test/v1/p1/test1/test1 0 0 8 0
/test/v1/p1/test1/test2 1 0 0 0
My search shows the data correctly and I see the visualization displays the chart properly, but when I convert that to a report and save it on the dashboard, it shows only 1 record which has data for 500 which is 8 records.
What might be the issue? Attached the images of how the data is shown on search/visualization chart and on the dashboard.
I tried on all kinds of browsers and its the same issue. Any help on what might be the issue would be appreciated.
... View more
02-08-2016
02:37 PM
Thanks that helped.. that is what I was looking for. Thank you for a quick reply.
... View more
02-08-2016
10:33 AM
We have tried to do using the spath, but I did not get the expected response as our log files are not json totally. Those are text log files which contains the json objects in middle somewhere.. please let me know if there is another way where we can extract the json object.
... View more
