Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About maddy1011
maddy1011
Explorer
Member since:
01-05-2016
06-05-2020
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 01-05-2016 |
Activity Feed
- Karma Re: How do I extract a field from a URL and group by that field? for javiergn. 06-05-2020 12:47 AM
- Karma Re: How do I extract a field from a URL and group by that field? for javiergn. 06-05-2020 12:47 AM
- Posted Re: How to extract the IP and customer_name field from my sample data? on Splunk Search. 05-20-2016 01:20 PM
- Posted Re: How to extract the IP and customer_name field from my sample data? on Splunk Search. 05-20-2016 12:40 PM
- Posted Re: How to extract the IP and customer_name field from my sample data? on Splunk Search. 05-20-2016 12:33 PM
- Posted How to extract the IP and customer_name field from my sample data? on Splunk Search. 05-12-2016 03:19 PM
- Tagged How to extract the IP and customer_name field from my sample data? on Splunk Search. 05-12-2016 03:19 PM
- Tagged How to extract the IP and customer_name field from my sample data? on Splunk Search. 05-12-2016 03:19 PM
- Tagged How to extract the IP and customer_name field from my sample data? on Splunk Search. 05-12-2016 03:19 PM
- Posted Re: How do I extract a field from a URL and group by that field? on Splunk Search. 01-12-2016 03:17 PM
- Posted Re: How do I extract a field from a URL and group by that field? on Splunk Search. 01-12-2016 03:15 PM
- Posted Re: How do I extract a field from a URL and group by that field? on Splunk Search. 01-05-2016 02:46 PM
- Posted How do I extract a field from a URL and group by that field? on Splunk Search. 01-05-2016 01:02 PM
- Tagged How do I extract a field from a URL and group by that field? on Splunk Search. 01-05-2016 01:02 PM
- Tagged How do I extract a field from a URL and group by that field? on Splunk Search. 01-05-2016 01:02 PM
- Tagged How do I extract a field from a URL and group by that field? on Splunk Search. 01-05-2016 01:02 PM
Topics I've Started
05-20-2016
01:20 PM
This seems to work, but still working on removing field extraction
sourcetype=xyz |rex START:\s(?(\d+.\d+.\d+.\d+))| stats count by IP_add, app|sort -count
Thanks!
... View more
05-20-2016
12:40 PM
Tried this, did not work, get the below error. (Just tried the rex for IP)
Error in 'rex' command: Encountered the following error while compiling the regex 'START:\s(?(\d+.\d+.\d+.\d+))': Regex: assertion expected after (?(
I think I just need the rex for extracting the list for IP, customer_name is an actual field so I could just use that directly.
... View more
05-20-2016
12:33 PM
I tried using extract field from the sample link. It did extract the IP as a field but just the sample one. Not in a way that would give me the list.
Also can you tell me how do I undo the extraction? all my search results are now defaulting to this extraction.
... View more
05-12-2016
03:19 PM
Hello,
I am trying to extract the IP address that is noted after START: and the customer name. A customer could have multiple IP addresses, so I want to list the all the IPs, customer name, and count for each.
How do I do that?
My log looks like this:
2016-05-09 20:18:05,403 57.0.2 [ttp-bio-942-exec-163] INFO LoggingFilter -- reqId=234c24a ******************> START: **10.182.50.95 /dsg/test-old/v1/testAll ss=hzufcnfo233rsm897qps&customer_name=abc&network=fa&view_network=fa&locale=en_US&qa=1
... View more
01-12-2016
03:17 PM
This gives me an error"
Error in 'SearchParser': Missing a search command before '\'. Error at position '132' of search query
not sure which "\" it's missing.
... View more
01-12-2016
03:15 PM
So I had to dig in a little bit and figured that the endpoint in the URL has different formats. And the one with // is not being captured. I was trying to see if I can list all unique endpoints, but still struggling.
Here are some more examples.
7 Jan 2015 17:12:44,500 RequestLog INFO :end: /XYZ/api/assets/customer_name?
Model=iphone&language=ge&
and
2 Jan 2015 14:57:45,121 RequestLogFilter INFO :end: /XYZ/api//dassets/customer_name2?deviceModel=iphone&language=ge&pageSize=1000&screenSize=0640x1136&assetQuality=hq
this is the one not being captured.
2 Jan 2015 15:18:29,913 RequestLogFilter INFO :end: /XYZ/api//dasset/customer_name3/localization?language=ge&deviceModel=iphone&assetQuality=hq&assetVersion=160&screenSize=0640x1136&api=2
... View more
01-05-2016
02:46 PM
This works but it omits certain results. Can you help explain the expression "\/(?[^\?\/]+)\?"
... View more
01-05-2016
01:02 PM
How do I group data and get a count for usage per customer? My data is Time and Event. The event data is a URL and the customer name is somewhere in the URL. How do I group by customer to get a count per customer?
It's something like this and customer_name is what I want to group by
Time Event
1/7/15 5:12:44.469 PM 7 Jan 2015 17:12:44,500 RequestLog INFO :end: /XYZ/api/assets/customer_name?
Model=iphone&language=ge&
... View more
