Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About almar_cabato
almar_cabato
New Member
Member since:
11-21-2018
06-05-2020
Community Statistics
| Posts | 5 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 11-21-2018 |
Activity Feed
- Posted Re: How do you make a regex field extraction to stop capture after underscore and last 2 digits? on Splunk Search. 02-20-2019 09:29 PM
- Posted Re: How do you make a regex field extraction to stop capture after underscore and last 2 digits? on Splunk Search. 02-19-2019 05:06 PM
- Posted How do you make a regex field extraction to stop capture after underscore and last 2 digits? on Splunk Search. 02-19-2019 10:45 AM
- Tagged How do you make a regex field extraction to stop capture after underscore and last 2 digits? on Splunk Search. 02-19-2019 10:45 AM
- Tagged How do you make a regex field extraction to stop capture after underscore and last 2 digits? on Splunk Search. 02-19-2019 10:45 AM
- Tagged How do you make a regex field extraction to stop capture after underscore and last 2 digits? on Splunk Search. 02-19-2019 10:45 AM
- Tagged How do you make a regex field extraction to stop capture after underscore and last 2 digits? on Splunk Search. 02-19-2019 10:45 AM
- Tagged How do you make a regex field extraction to stop capture after underscore and last 2 digits? on Splunk Search. 02-19-2019 10:45 AM
- Posted Re: How do I set choice value if I need fields where value is greater than zero? on Getting Data In. 11-22-2018 12:15 PM
- Posted How do I set choice value if I need fields where value is greater than zero? on Getting Data In. 11-21-2018 02:47 AM
- Tagged How do I set choice value if I need fields where value is greater than zero? on Getting Data In. 11-21-2018 02:47 AM
Topics I've Started
02-20-2019
09:29 PM
Thank you very much! This works for me now. 🙂
... View more
02-19-2019
05:06 PM
Thank you marycordova. This is almost close to what I'm looking for. But if my data changes to something like:
/path1/path2/path3/path4/path5/car_Nam-Cluster_01_201902190559_41795
/path1/path2/path3/path4/path5/car_Nam-Cluster_02_201902190559_41796
/path1/path2/path3/path4/path5/car_Nam-Cluster_03_201902190559_41797
/path1/path2/path3/path4/path5/car_Asia-Cluster_01_201902190559_41795
/path1/path2/path3/path4/path5/car_Asia-Cluster_02_201902190559_41796
/path1/path2/path3/path4/path5/car_Asia-Cluster_03_201902190559_41797
/path1/path2/path3/path4/path5/car_EMEA-Cluster_01_201902190559_41795
/path1/path2/path3/path4/path5/car_EMEA-Cluster_02_201902190559_41796
/path1/path2/path3/path4/path5/car_EMEA-Cluster_03_201902190559_41797
/path1/path2/path3/path4/path5/car_India-Cluster_01_201902190559_41795
/path1/path2/path3/path4/path5/car_India-Cluster_02_201902190559_41796
/path1/path2/path3/path4/path5/car_India-Cluster_03_201902190559_41797
it only captures,
car_Nam-Cluster_01
car_Nam-Cluster_02
car_Nam-Cluster_03
but not,
car_Asia-Cluster_01
car_Asia-Cluster_02
car_Asia-Cluster_03
car_EMEA-Cluster_01
car_EMEA-Cluster_02
car_EMEA-Cluster_03
car_India-Cluster_01
car_India-Cluster_02
car_India-Cluster_03
Thank you!
... View more
02-19-2019
10:45 AM
Hi,
I'm new to regex field extraction. I need a regex to capture only specific characters on my event source. I tried .car_(?.+20) but it gives me an output that I don't want:
Nam-Cluster_01_20
Nam-Cluster_02_20
Nam-Cluster_03_201902191052_20
Sample File Path:
/path1/path2/path3/path4/path5/car_Nam-Cluster_01_201902190559_41795
/path1/path2/path3/path4/path5/car_Nam-Cluster_01_201902190559_41795
/path1/path2/path3/path4/path5/car_Nam-Cluster_01_201902190557_41794
/path1/path2/path3/path4/path5/car_Nam-Cluster_02_201902191428_194444
/path1/path2/path3/path4/path5/car_Nam-Cluster_02_201902190754_194346
/path1/path2/path3/path4/path5/car_Nam-Cluster_02_201902190754_194346
/path1/path2/path3/path4/path5/car_Nam-Cluster_03_201902191052_209807
Needed Output:
car_Nam-Cluster_01
car_Nam-Cluster_02
car_Nam-Cluster_03
Thank you!
... View more
11-22-2018
12:15 PM
Thanks, let me try it.
Regards,
Almar
... View more
11-21-2018
02:47 AM
I tried below:
<input type="radio" token="duration.input" searchWhenChanged="true">
<label>Call Duration</label>
<choice value=">0">Non-Zero</choice>
<choice value="0">Zero</choice>
<choice value="*">All</choice>
<default>All</default>
</input>
sourcetype=callrecords
duration="$duration.input$"
| table field1, field2, field3
</query>
I cannot get this working when I choose "Non-Zero."
Thanks a lot.
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
