About marcosrios

stephanefotso · ‎04-21-2016

Run your base search and save it as a report. Let say top_errors Reference your report like this: Search from report Original report Top Errors (Past 10 minutes) <search ref="top_errors" />  <earliest>-10m</earliest> <latest>now</latest> </chart> </panel> <panel> <title>Modified time bounds and visualization</title> <chart> <title>Top Errors (Past 4 hours)</title> <search ref="top_errors">  <earliest>-4h</earliest> <latest>now</latest> </search>  <option name="charting.chart">column</option> </chart> </panel> </row> </dashboard>

somesoni2 · ‎04-06-2016

Give this a try index=vts sourcetype=vtsr host=server* "Batch Processor is turned ON" | stats count(host) as hostCount by host | eventstats sum(hostCount) as total | where hostCount<2 OR total<12

lguinn2 · ‎03-30-2016

xmlkv tries to dynamically find all key-value pairs within the search results, so it can be quite slow. You are already extracting some fields with rex - you could extract additional fields in the same way. The more fields that exist in the xml, the longer xmlkv will run. So using rex to extract only the fields that you need can be faster. What do you plan to do after the xmlkv step?

marcosrios · ‎03-22-2016

My bad. This is working. source="txn.log" host="none" sourcetype= "txn log"| rex "(?<timestamp>(\d{4}-\d{2}-\d{2} \d{2}\:\d{2}\:\d{2}\,\d{3})) (?<loglevel>DEBUG|INFO|WARN|ERROR) (?<origin>\[.*\]) (?s)(?<content>.*)" | xmlkv

richgalloway · ‎03-04-2016

Try using the single-line modifier by putting "(?s)" at the beginning of your regex string.

Posts	8
Solutions	1
Karma Given	0
Karma Received	1
Member Since	‎03-04-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How to specify different time ranges for each pane...

retrieve host count depending on host value

improve xmlkv performance

Parse log and extract fields from xml

How to edit my rex statement to ignore line breaks...

Re: How to specify different time ranges for each ...

Re: retrieve host count depending on host value

Re: improve xmlkv performance

Re: Parse log and extract fields from xml

Re: How to edit my rex statement to ignore line br...

Are you a member of the Splunk Community?