Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About abhishekgandhe
abhishekgandhe
Explorer
Member since:
10-16-2018
06-05-2020
Community Statistics
| Posts | 17 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 10-16-2018 |
Activity Feed
- Got Karma for AND Condition to find the keywords in logs. 06-05-2020 12:50 AM
- Posted How do I extract a value from the the following JSON? on Splunk Search. 12-05-2018 10:57 PM
- Tagged How do I extract a value from the the following JSON? on Splunk Search. 12-05-2018 10:57 PM
- Posted Re: Multiple fields for email notification on Deployment Architecture. 12-05-2018 07:37 PM
- Posted Multiple fields for email notification on Deployment Architecture. 12-05-2018 02:38 AM
- Tagged Multiple fields for email notification on Deployment Architecture. 12-05-2018 02:38 AM
- Posted How do you find the difference between the count of 2 keywords? on Splunk Search. 12-04-2018 10:16 PM
- Tagged How do you find the difference between the count of 2 keywords? on Splunk Search. 12-04-2018 10:16 PM
- Tagged How do you find the difference between the count of 2 keywords? on Splunk Search. 12-04-2018 10:16 PM
- Tagged How do you find the difference between the count of 2 keywords? on Splunk Search. 12-04-2018 10:16 PM
- Posted Re: How do you make a regex to extract the following value? on Splunk Search. 11-29-2018 12:35 AM
- Posted How do you make a regex to extract the following value? on Splunk Search. 11-28-2018 11:27 PM
- Tagged How do you make a regex to extract the following value? on Splunk Search. 11-28-2018 11:27 PM
- Tagged How do you make a regex to extract the following value? on Splunk Search. 11-28-2018 11:27 PM
- Tagged How do you make a regex to extract the following value? on Splunk Search. 11-28-2018 11:27 PM
- Posted Re: AND Condition to find the keywords in logs on Splunk Search. 10-29-2018 11:44 PM
- Posted Re: How do you extract the value of output quality from the log below? on Splunk Search. 10-29-2018 11:43 PM
- Posted How do you extract the value of output quality from the log below? on Splunk Search. 10-28-2018 11:21 PM
- Tagged How do you extract the value of output quality from the log below? on Splunk Search. 10-28-2018 11:21 PM
- Tagged How do you extract the value of output quality from the log below? on Splunk Search. 10-28-2018 11:21 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
12-05-2018
10:57 PM
I want to extract the following values from below JSON. Values needs to be extracted from the highlighted text in Bold.
model-cps-kkru-qa2 , Data Reconciliation, Honeywell.PMT.UOP.CPS.UniSimTaskService.exe.
{"message":[{"raw":"06/12/18 05:37:47 [19] INFO :: TenantId = model-cps-kkru-qa2 :: JobId = 85db2e7e-8b6a-4482-9d0f-40d7c48c7aa1 :: CalcType = Data Reconciliation :: UniSimInvokerServices.UniSimApplicationServices : UniSim Job Run completed successfully!","severityLevel":"Informational","className":"Honeywell.PMT.UOP.CPS.UniSimTaskService.UniSimEventProcessorHost+d__23","methodName":"MoveNext","lineNumber":389,"domain":"Honeywell.PMT.UOP.CPS.UniSimTaskService.exe","loggerName":"UTELogger","threadName":"19"}],"internal":{"data":{"id":"1d75acfe-f919-11e8-b912-eb327d060bc3","documentVersion":"1.61"}},"context":{"data":{"eventTime":"2018-12-06T05:37:47.8836038Z","isSynthetic":false,"samplingRate":100.0},"cloud":{},"device":{"type":"PC","roleInstance":"usd-qa-wk2-eus","screenResolution":{}},"session":{"isFirst":false},"operation":{},"location":{"clientip":"0.0.0.0","continent":"North America","country":"United States","province":"Virginia","city":"Boydton"},"custom":{"dimensions":[{**"TenantId":"model-cps-kkru-qa2"**},{"LoggerName":"UTELogger"},{**"CalcType":"Data Reconciliation"**},{"JobId":"85db2e7e-8b6a-4482-9d0f-40d7c48c7aa1"},{"MethodName":"MoveNext"},{"LineNumber":"389"},{**"Domain":"Honeywell.PMT.UOP.CPS.UniSimTaskService.exe"**},{"ThreadName":"19"},{"ClassName":"Honeywell.PMT.UOP.CPS.UniSimTaskService.UniSimEventProcessorHost+d__23"},{"FileName":"C:\\Users\\E542204\\Source\\Repos\\cps-unisim-taskexecutor\\Honeywell.PMT.UOP.CPS.UniSimTaskExecutor\\UniSimEventProcessorHost.cs"}]}}}
... View more
- Tags:
- splunk-enterprise
12-05-2018
07:37 PM
This is the search string: -
index=cpsprod sourcetype="mscs:storage:blob:cps-prod-unisim-taskexecutor" "message{}.severityLevel"=Error "context.data.eventTime"="" "context.custom.dimensions{}.CalcType"="" "context.custom.dimensions{}.TenantId"="*"
I am getting eventTime using $result.context.data.eventTime$.
Not getting values for $result.context.custom.dimensions{}.TenantId$ and $result.context.custom.dimensions{}.CalcType$
... View more
12-05-2018
02:38 AM
Following is my JSON data: -
{
"message": [
{
"raw": "04/12/18 14:03:56 [28] ERROR :: TenantId = model-cps-czooarea05nap01 :: JobId = 383d529e-4d7a-465d-8823-798d6e661788 :: CalcType = Process Monitor :: UniSimInvokerServices.HttpHelper : Complete Exception Details: System.Threading.Tasks.TaskCanceledException: A task was canceled.\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Net.Http.HttpClient. d_58.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()\r\n at UniSimInvokerServices.HttpHelper. d 3.MoveNext() in C:\Users\E542204\Source\Repos\cps-unisim-taskexecutor\Honeywell.PMT.UOP.CPS.UniSimInvoker\HttpHelper.cs:line 66",
"severityLevel": "Error",
"className": "UniSimInvokerServices.HttpHelper+ d 3",
"methodName": "MoveNext",
"lineNumber": 115,
"domain": "Honeywell.PMT.UOP.CPS.UniSimTaskService.exe",
"loggerName": "UTELogger",
"threadName": "28"
}
],
"internal": {
"data": {
"id": "7f55dcd3-f7cd-11e8-b587-fb20626c7e32",
"documentVersion": "1.61"
}
},
"context": {
"data": {
"eventTime": "2018-12-04T14:03:56.7939778Z",
"isSynthetic": false,
"samplingRate": 100
},
"cloud": {},
"device": {
"type": "PC",
"roleInstance": "usd-qa-wk1-eus",
"screenResolution": {}
},
"session": {
"isFirst": false
},
"operation": {},
"location": {
"clientip": "0.0.0.0",
"continent": "North America",
"country": "United States",
"province": "Virginia",
"city": "Boydton"
},
"custom": {
"dimensions": [
{
"TenantId": "model-cps-czooarea05nap01"
},
{
"LoggerName": "UTELogger"
},
{
"CalcType": "Process Monitor"
},
{
"JobId": "383d529e-4d7a-465d-8823-798d6e661788"
},
{
"MethodName": "MoveNext"
},
{
"LineNumber": "115"
},
{
"Domain": "Honeywell.PMT.UOP.CPS.UniSimTaskService.exe"
},
{
"ThreadName": "28"
},
{
"ClassName": "UniSimInvokerServices.HttpHelper+ d _3"
},
{
"FileName": "C:\Users\E542204\Source\Repos\cps-unisim-taskexecutor\Honeywell.PMT.UOP.CPS.UniSimInvoker\HttpHelper.cs"
}
]
}
}
}
I want to use the fields - TenantId, CalcType, ClassName, eventTime - in the email notification.
How to use these fields in email alert? What will be search string for such scenario?
... View more
- Tags:
- splunk-enterprise
12-04-2018
10:16 PM
I have 2 keywords.
"UniSim Job received" and "UniSim Job Run completed successfully".
I want to find the difference between the count of these 2 keywords.
... View more
11-29-2018
12:35 AM
It has given me everything coming after systemGuid=. I just want value between = and comma.
systemGuid=9516e36a-e5e9-4ec5-a449-edcaeb5f227f,
The actual string where I am extracting the value is this: -
systemGuid=9516e36a-e5e9-4ec5-a449-edcaeb5f227f, calculationName=Data Reconciliation, pointId=fi_12101_01.pv_ag, batchId=, modelId=model-cps-kkru-qa2, unisimModelName=CPS_PLATF_R, epochUTC=1543310100000, itemValue=372891.642424334, itemValueStr=null, quality=Good, timeOffset=P0000)","severityLevel":"Informational","timestamp":"2018-11-27T09:31:11+00:00","sourceType":"LOGBack","loggerName":"com.honeywell.pmt.cps.dao.RcDataPointDaoImpl","level":"INFO","threadName":"Thread-19"}],"internal":{"data":{"id":"2d554756-f227-11e8-b34a-1953e7591063","documentVersion":"1.61"}},"context":{"data":{"eventTime":"2018-11-27T09:31:11.027Z","isSynthetic":false,"samplingRate":100.0},"device":{"id":"2d52dcf8e7d2","type":"PC","osVersion":"Linux","roleInstance":"2d52dcf8e7d2","deviceName":"Other","deviceModel":"Other","locale":"en-US","browser":"Apache-HttpClient","browserVersion":"Apache-HttpClient 4.5","screenResolution":{}},"user":{"isAuthenticated":false},"session":{"isFirst":false},"operation":{},"location":{"clientip":"0.0.0.0","continent":"North America","country":"United States","province":"Virginia","city":"Boydton"},"custom":{"dimensions":[{"LoggerName":"com.honeywell.pmt.cps.dao.RcDataPointDaoImpl"},{"LoggingLevel":"INFO"},{"SourceType":"LOGBack"},{"ThreadName":"Thread-19"},{"TimeStamp":"Tue,
... View more
11-28-2018
11:27 PM
Hi,
I want to extract a value from the following line:
systemGuid=9516e36a-e5e9-4ec5-a449-edcaeb5f227f,
I need the value between systemGuid= and comma (,) at the end. I am looking for value 9516e36a-e5e9-4ec5-a449-edcaeb5f227f from the above line.
... View more
10-29-2018
11:44 PM
I have written REGEX for this. Is this the correct one.
index="cpsprod" sourcetype="mscs:storage:blob:cps-qa-rc-calc" (Critical-Lab AND \"LAB AND Critical-Process AND \"Process)
... View more
10-29-2018
11:43 PM
I just don't have 4 lines, but there are multiple lines. How to write one REGEX.
I tried below REGEX, but could not got the desired result.
index="cpsprod" sourcetype="mscs:storage:blob:cps-qa-rc-calc" "batchId ==>""==true :: Output Quality" | rex field=logs max_match=0 "Output Quality (?P\d+.\d+\%)" | table Quality
... View more
10-28-2018
11:21 PM
I want to extract the value of Output Quality from the below log.
Critical-Lab checkRcReady for batchId ==>9a508f01-4e93-4d76-9a9d-fe1cf8bd0550==true :: Output Quality 0.0%"
Output Quality is 0.0%. I want to extract this value. How do you do it with regex?
... View more
10-28-2018
11:18 PM
"Critical-Lab checkRcReady for batchId ==>9a508f01-4e93-4d76-9a9d-fe1cf8bd0550==true :: Output Quality 0.0%"
... View more
10-28-2018
09:37 PM
1 Karma
I have log. I want to find all 4 keywords. It should be AND condition and not OR.
Critical Lab
Lab
Critical Process
Process
If any one of them is not present then fail. If all 4 present then pass.
How to do it in Regex.
... View more
- Tags:
- splunk-enterprise
10-25-2018
01:28 AM
Thanks it worked
... View more
10-17-2018
02:59 AM
Here are some logs
{"message":[{"raw":"Lab checkRcReady for batchId ==>2d465022-fb3a-4584-a9c4-6cec867e6694==true :: Output Quality 41.6289592760181%","severityLevel":"Informational","timestamp":"2018-10-17T09:30:47+00:00","sourceType":"LOGBack","loggerName":"com.honeywell.pmt.cps.service.JobformationServiceImpl","level":"INFO","threadName":"pool-29-thread-1"}],"internal":{"data":{"id":"5665ef35-d1ef-11e8-9c0f-9b51e6fd477d","documentVersion":"1.61"}},"context":{"data":{"eventTime":"2018-10-17T09:30:47.923Z","isSynthetic":false,"samplingRate":100.0},"device":{"id":"e5fae3de5734","type":"PC","osVersion":"Linux","roleInstance":"e5fae3de5734","deviceName":"Other","deviceModel":"Other","locale":"en-US","browser":"Apache-HttpClient","browserVersion":"Apache-HttpClient 4.5","screenResolution":{}},"user":{"isAuthenticated":false},"session":{"isFirst":false},"operation":{},"location":{"clientip":"0.0.0.0","continent":"North America","country":"United States","province":"Virginia","city":"Boydton"},"custom":{"dimensions":[{"LoggerName":"com.honeywell.pmt.cps.service.JobformationServiceImpl"},{"LoggingLevel":"INFO"},{"SourceType":"LOGBack"},{"TimeStamp":"Wed, 17 Oct 2018 09:30:47 GMT"},{"systemGuid":"9516e36a-e5e9-4ec5-a449-edcaeb5f227f"},{"pointId":"fi_12101_01.pv_ag"},{"ThreadName":"pool-29-thread-1"},{"endTime":"1539232140000"}]}}}
... 3 lines omitted ...
{"message":[{"raw":"Critical-Lab checkRcReady for batchId ==>16cfe3ea-52be-4017-b2b2-aedbb360d150==true :: Output Quality 0.0%","severityLevel":"Informational","timestamp":"2018-10-17T09:30:49+00:00","sourceType":"LOGBack","loggerName":"com.honeywell.pmt.cps.service.JobformationServiceImpl","level":"INFO","threadName":"pool-29-thread-1"}],"internal":{"data":{"id":"5665ef39-d1ef-11e8-9c0f-9b51e6fd477d","documentVersion":"1.61"}},"context":{"data":{"eventTime":"2018-10-17T09:30:49.321Z","isSynthetic":false,"samplingRate":100.0},"device":{"id":"e5fae3de5734","type":"PC","osVersion":"Linux","roleInstance":"e5fae3de5734","deviceName":"Other","deviceModel":"Other","locale":"en-US","browser":"Apache-HttpClient","browserVersion":"Apache-HttpClient 4.5","screenResolution":{}},"user":{"isAuthenticated":false},"session":{"isFirst":false},"operation":{},"location":{"clientip":"0.0.0.0","continent":"North America","country":"United States","province":"Virginia","city":"Boydton"},"custom":{"dimensions":[{"LoggerName":"com.honeywell.pmt.cps.service.JobformationServiceImpl"},{"LoggingLevel":"INFO"},{"SourceType":"LOGBack"},{"TimeStamp":"Wed, 17 Oct 2018 09:30:49 GMT"},{"systemGuid":"9516e36a-e5e9-4ec5-a449-edcaeb5f227f"},{"pointId":"fi_12101_01.pv_ag"},{"ThreadName":"pool-29-thread-1"},{"endTime":"1539239340000"}]}}}
... 9 lines omitted ...
{"message":[{"raw":"Critical-Lab checkRcReady for batchId ==>85d82866-11be-447d-a06c-5ed1bb727a13==true :: Output Quality 0.0%","severityLevel":"Informational","timestamp":"2018-10-17T09:30:52+00:00","sourceType":"LOGBack","loggerName":"com.honeywell.pmt.cps.service.JobformationServiceImpl","level":"INFO","threadName":"pool-29-thread-1"}],"internal":{"data":{"id":"598e0a35-d1ef-11e8-8b3a-4b8260d9fc0d","documentVersion":"1.61"}},"context":{"data":{"eventTime":"2018-10-17T09:30:52.616Z","isSynthetic":false,"samplingRate":100.0},"device":{"id":"e5fae3de5734","type":"PC","osVersion":"Linux","roleInstance":"e5fae3de5734","deviceName":"Other","deviceModel":"Other","locale":"en-US","browser":"Apache-HttpClient","browserVersion":"Apache-HttpClient 4.5","screenResolution":{}},"user":{"isAuthenticated":false},"session":{"isFirst":false},"operation":{},"location":{"clientip":"0.0.0.0","continent":"North America","country":"United States","province":"Virginia","city":"Boydton"},"custom":{"dimensions":[{"LoggerName":"com.honeywell.pmt.cps.service.JobformationServiceImpl"},{"LoggingLevel":"INFO"},{"SourceType":"LOGBack"},{"TimeStamp":"Wed, 17 Oct 2018 09:30:52 GMT"},{"systemGuid":"9516e36a-e5e9-4ec5-a449-edcaeb5f227f"},{"pointId":"fi_12101_01.pv_ag"},{"ThreadName":"pool-29-thread-1"},{"endTime":"1539404040000"}]}}}
... View more
10-16-2018
07:36 PM
I want to find whether logfile has 0 events in last 2 hrs. If it has 0 events, that's means no new logs are created in last 2 hrs. If 0 events, then I should alert the system.
... View more
10-16-2018
07:33 PM
My mistake. I should have given full requirement.
I want to first find the batchID and then corresponding true/false value for it.
Thanks
... View more
10-16-2018
12:10 AM
Hi,
I have to find the value of true or false from the following string in logfile. Below are 2 strings with either a true or false value. I just want to find a string with a false value and create an alert.
How do I achieve this?
batchId ==>9459a2b3-871c-4f1b-aece-feb905121b3f==false
batchId ==>14c86ffd-2ae5-4848-995e-6923485c9ed6==true
Thanks
... View more
- Tags:
- splunk-enterprise
10-16-2018
12:06 AM
Hi,
I have a requirement. If a logfile is not created, then Splunk should alert the system.
How can we achieve this?
Thanks
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
