Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About nidhiagrawal
nidhiagrawal
Explorer
Member since:
12-02-2015
06-05-2020
Community Statistics
| Posts | 7 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 12-02-2015 |
Activity Feed
- Got Karma for How can I limit the number of events returned from a search?. 06-05-2020 12:47 AM
- Posted Using head command on Splunk Search. 12-23-2015 09:35 PM
- Tagged Using head command on Splunk Search. 12-23-2015 09:35 PM
- Tagged Using head command on Splunk Search. 12-23-2015 09:35 PM
- Posted Re: How can I limit the number of events returned from a search? on Splunk Search. 12-16-2015 02:04 PM
- Posted How can I limit the number of events returned from a search? on Splunk Search. 12-16-2015 10:02 AM
- Tagged How can I limit the number of events returned from a search? on Splunk Search. 12-16-2015 10:02 AM
- Tagged How can I limit the number of events returned from a search? on Splunk Search. 12-16-2015 10:02 AM
- Tagged How can I limit the number of events returned from a search? on Splunk Search. 12-16-2015 10:02 AM
- Posted Re: How do I edit my search to get the average response time without using the transaction command? on Splunk Search. 12-15-2015 10:48 AM
- Posted How do I edit my search to get the average response time without using the transaction command? on Splunk Search. 12-15-2015 10:04 AM
- Tagged How do I edit my search to get the average response time without using the transaction command? on Splunk Search. 12-15-2015 10:04 AM
- Tagged How do I edit my search to get the average response time without using the transaction command? on Splunk Search. 12-15-2015 10:04 AM
- Posted Re: I need to extract xml tag values, but I dont want to use spath. how can i do it using regex? on Splunk Search. 12-02-2015 02:01 PM
- Posted I need to extract xml tag values, but I dont want to use spath. how can i do it using regex? on Splunk Search. 12-02-2015 01:14 PM
- Tagged I need to extract xml tag values, but I dont want to use spath. how can i do it using regex? on Splunk Search. 12-02-2015 01:14 PM
- Tagged I need to extract xml tag values, but I dont want to use spath. how can i do it using regex? on Splunk Search. 12-02-2015 01:14 PM
- Tagged I need to extract xml tag values, but I dont want to use spath. how can i do it using regex? on Splunk Search. 12-02-2015 01:14 PM
- Tagged I need to extract xml tag values, but I dont want to use spath. how can i do it using regex? on Splunk Search. 12-02-2015 01:14 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
12-23-2015
09:35 PM
I have the query with stats, and I want to use head command to retrieve limited events for everyday. But head command is limiting the events for whole query.
index=myindex "searchQuery" | rex "<messageId>(?<myMsgId>[^<]+)" | rex "refToMessageId>(?<myMsgId>[^<]+)" | rex field=_raw "(?<fldDay>[\d-]{10}).*\s[\s[a-zA-Z0-9-:.]" stats earliest(_time) AS startTime, latest(_time) AS endTime, count as TotalEvents by fldDay , myMsgId | eval responseTime=endTime-startTime | where TotalEvents = 2 | stats avg(responseTime) as avgResponseTime by fldDay
... View more
12-16-2015
02:04 PM
Does head have an option to pick random events. if I choose 100,000 then it will be first of those. But ideally i would like to scatter the events during the given time range.
... View more
12-16-2015
10:02 AM
1 Karma
I'm using Splunk to build some of the basic metrics. Events which are returned run in millions. I have to look for daily average response time, and have to run this search over a week of time. What is the option to limit my search to specific number of events say 100,000? Changing the time duration is not an option.
... View more
12-15-2015
10:48 AM
Can I please ask a follow up question. how do I add the condition: calculate average only if TotalEvents > 1.
... View more
12-15-2015
10:04 AM
I am trying to get average response time without the transaction command. Events are running into millions, so the search takes a lot of time.
Here is what I have:
index=myindex "string to match" | rex "messageId(?<myMsgId>[^\<]+)" | rex "refToMessageId(?<myMsgId>[^\<]+)" | rex field=_raw "(?<fldDay>[\d\-]{10}).*\s\[\s[a-zA-Z0-9\-\:\.]" | stats earliest(_time) AS startTime, latest(_time) AS endTime, count as TotalEvents by fldDay, myMsgId | eval responseTime=endTime-startTime
It should be simple, but I'm a novice here. How do I get the average of response time?
Thanks in advance.
... View more
12-02-2015
02:01 PM
Thanks, and you are right I was trying to extract in myMsgId.
I looked at my data again and there is a minor issue. There is a request xml and response xml. Response xml has both elements <messageId> and <refToMessageId>. Request xml only has <messageId>. So the regex is capturing the messageId element, whereas I need to match it with <refToMessageId>. Can regex be modified to match it with refToMessageId, and if refToMessageId is not avaialble then match with messageId.
MessageId from request matches with refToMessageId from response. So I am trying to use these elements to evaluate response time.
("xyzRequest>" OR "xyzResponse>" ) "-fd9035a:151642200c0:-37c2" | stats earliest(_time) AS startTime, latest(_time) AS endTime | eval responseTime=endTime-startTime
... View more
12-02-2015
01:14 PM
Here is the sample xml. There will be only one of the below tags in xml.
<refToMessageId>-fd9035a:151642200c0:-37c2</refToMessageId>
<messageId>-fd9035a:151642200c0:-37c2</messageId>
I want to extract myMsgId, using regex.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
