Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About mark_groenveld
mark_groenveld
Path Finder
Member since:
05-19-2016
10-29-2025
Community Statistics
| Posts | 25 |
| Solutions | 0 |
| Karma Given | 11 |
| Karma Received | 1 |
| Member Since | 05-19-2016 |
Activity Feed
- Karma Re: Need a rex to extract an ip address with a trailing port number for ITWhisperer. 04-26-2025 11:36 AM
- Posted Need a rex to extract an ip address with a trailing port number on Splunk Search. 04-26-2025 10:27 AM
- Posted Re: How To Use Eval to Capture Inconsistent key:values on Splunk Search. 03-28-2025 11:35 AM
- Karma Re: How To Use Eval to Capture Inconsistent key:values for livehybrid. 03-28-2025 11:35 AM
- Posted Re: How To Use Eval to Capture Inconsistent key:values on Splunk Search. 03-27-2025 11:37 AM
- Posted Re: How To Use Eval to Capture Inconsistent key:values on Splunk Search. 03-27-2025 11:36 AM
- Posted Re: How To Use Eval to Capture Inconsistent key:values on Splunk Search. 03-26-2025 12:04 PM
- Posted How To Use Eval to Capture Inconsistent key:values on Splunk Search. 03-26-2025 11:44 AM
- Posted Re: Exclude Saturday and Sunday from monthly repirt on Reporting. 10-23-2024 01:22 PM
- Karma Re: Exclude Saturday and Sunday from monthly repirt for ITWhisperer. 10-23-2024 12:36 PM
- Posted Comparing results from two different dates vertically on Splunk Search. 09-27-2024 11:38 AM
- Got Karma for Re: How can I represent the stats for 5 minutes before and the top of the hour?. 01-08-2024 05:11 PM
- Posted Re: How can I represent the stats for 5 minutes before and the top of the hour? on Splunk Search. 01-08-2024 05:07 PM
- Karma Re: How can I represent the stats for 5 minutes before and the top of the hour? for dtburrows3. 01-08-2024 05:07 PM
- Karma Re: How can I represent the stats for 5 minutes before and the top of the hour? for dtburrows3. 01-08-2024 05:07 PM
- Posted Re: How can I represent the stats for 5 minutes before and the top of the hour? on Splunk Search. 01-08-2024 10:58 AM
- Posted How can I represent the stats for 5 minutes before and the top of the hour? on Splunk Search. 01-08-2024 10:35 AM
- Posted Re: How can I extract just a section of a field? on Splunk Search. 12-19-2023 12:12 PM
- Karma Re: How can I extract just a section of a field? for dtburrows3. 12-19-2023 12:11 PM
- Posted How can I extract just a section of a field? on Splunk Search. 12-19-2023 10:29 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-26-2025
10:27 AM
I would like to extract an ip address from a text field where the ip address has a trailing port number. The text is like so: X-Upstream:"11.111.11.11:81" The extraction would provide only the ip address. Thanks.
... View more
03-28-2025
11:35 AM
Thanks for posting livehybrid. The rex did not work. Karma points to you for giving it a go 👊
... View more
03-27-2025
11:37 AM
I am looking for a way to pull out CLUSTER1 as a single value as there are two other clusters, CLUSTER2 AND CLUSTER3. Thanks
... View more
03-27-2025
11:36 AM
Here are 2 examples of the values for the events: {"CLUSTER1.COM","viewSiteAsUser.hasAccess":true} {"CLUSTER_VIP":"CLUSTER1.COM"}
... View more
03-26-2025
12:04 PM
Sure. Here are examples of the values. {"CLUSTER1.COM","viewSiteAsUser.hasAccess":true} {"CLUSTER_VIP":"CLUSTER1.COM"}
... View more
03-26-2025
11:44 AM
I am searching for a key:value report app where the values are inconsistent but include a report cluster name consistently. Example of key:value APP_Details:{"CLUSTER_VIP":"CLUSTERX.URL.COM","Access":true} There are over 100 APP_Details values for CLUSTERX. How can I extract CLUSTERX (there are three different cluster names) to show as a single value by cluster? Thanks
... View more
Labels
- Labels:
-
eval
-
field extraction
-
stats
10-23-2024
01:22 PM
I tried this and it still showed results for a stats or timechart output.
... View more
09-27-2024
11:38 AM
I would like to compare specific response status stats vertically and not horizontally so that the values line up and do not rely on the appendcols command.
My search:
| multisearch [search NOT status IN ( 200, 203, 204, 302, 201, 202, 206, 301, 304, 404, 500, 400, 401, 403, 502, 504 ) earliest=-4h@m latest=@m | eval date="Today"] [search NOT status IN (200, 203, 204, 302, 201, 202, 206, 301, 304, 404, 500, 400, 401, 403, 502, 504 ) earliest=-4h@m-1w latest=@m-1w | eval date="LastWeek"] | timechart span=1d count by status
Example display of current results
Desired results
Status
Today
LastWeek
412
1
0
413
1
0
415
0
1
418
0
2
422
6
7
... View more
Labels
- Labels:
-
timechart
01-08-2024
05:07 PM
1 Karma
I found a shorter example to display the result set. Thank you for your efforts dtburrows3. | bin span=10m _time | eval minute=strftime(_time,"%M") | where minute>54 OR minute<6 | stats count by _time
... View more
01-08-2024
10:58 AM
Thanks dtburrows3 for replying. The chiefs requesting the data want 10 minute increments.
... View more
01-08-2024
10:35 AM
I am looking to represent stats for the 5 minutes before and after the hour for an entire day/timeperiod. The search below will work but still breaks up the times into 5 minute chunks as it crosses the top of the hour. Is there a better way to search? index=main (earliest=01/08/2024:08:55:00 latest=01/08/2024:09:05:00) OR (earliest=01/08/2024:09:55:00 latest=01/08/2024:10:05:00) OR (earliest=01/08/2024:10:55:00 latest=01/08/2024:11:05:00) | bin _time span=10m | stats count by _time Received results
... View more
Labels
- Labels:
-
stats
12-19-2023
12:12 PM
That worked. Thanks dtburrows3!
... View more
12-19-2023
10:29 AM
I have a key called message Inside the value are several results but I need to only extract one result in the middle of the results. Sample: message: template: 1234abcd, eeid: 5678efgh, consumerid: broker My rex is below but returns the template value but also the results for eeid and consumerid when I only need the template value of 1234abcd. | rex field=message "template: (?<TemplateID>[^-]+)"
... View more
Labels
- Labels:
-
rex
11-08-2023
04:49 PM
I need the count of events.
... View more
11-08-2023
01:54 PM
Thanks Robert. I would like to clarify the search as I need the events less than the p95 duration. Shouldn't the eval section be: | eval search = "dur<"+p95Dur
... View more
11-08-2023
01:51 PM
Thanks for your response Rich. Using eventstats took too long to complete to the point it wasn't usable.
... View more
11-07-2023
11:01 AM
I need to identify the count of events that have a duration that is less than the p95 value. Sample search index=xyz status=complete | stats p95(dur) as p95Dur What can I add to the end of the search to id the number of events less than the p95Dur value?
... View more
Labels
- Labels:
-
stats
08-16-2023
08:36 AM
That works. Many thanks!
... View more
08-15-2023
11:14 AM
I am looking to sum up cumulative column totals by hour in a separate column. Here is the search: index=main CompletedEvent | bin _time span=1h | stats dc(clientid) as HourlyClients by _time I would like there to be a 2nd result column that accumulates the 1st column by hour. For example: the result in row 2 of the 2nd column will be the sum of rows 1 and 2 in the 1st column, the result of row 3 of the 2nd column will be the sum of rows 1 to 3 in the 1st column, etc. Thanks in advance.
... View more
Labels
- Labels:
-
stats
10-25-2022
01:01 PM
That worked. Many thanks!
... View more
10-24-2022
10:02 PM
We are looking to provide the last part of a request uri that identifies a file name and has a client identifier variable in the middle of the uri. Sample uri request: GET /someportal/rest/product/v1_0/clientidentifier/filename/fnm_123456789abcd.png HTTP/1.1 The underlined text is the value that I need to extract. Note the space after the .png. My current attempt is this: index=index source=/source sourcetype=sourcetype | rex field=_raw "GET /someportal/rest/product/v1_0/*/filename/(?<FileName>\d+)" Please let me know how far off I am. Thanks
... View more
08-15-2022
05:44 PM
Thanks Rich for the solution.
... View more
08-12-2022
04:51 PM
I have a key:value for db names but need only the first part.
Example
Current DBNAME : db001_inst1:schemanamexyx Or DBNAME : db01_inst1:schemanamexyx
Requested REX statement to provide only the values in front of the colon. I.E., db001_inst1 or db01_inst1
... View more
07-20-2016
06:04 PM
This is great. I have been busting on this for quite some time. I was able to get it to work by using the format below. Thanks a bunch for the tip.
This provides a search between 8am and 10pm for the day or days selected.
ERRORCODE=001 | eval hour_of_the_day=strftime(_time,"%H") | where hour_of_the_day>07 | where hour_of_the_day<22
... View more
05-19-2016
09:44 PM
We would like to count the number of error events in 15 minute intervals and show that number as the number of errors per minute for the previous 15 minutes. How would I do that using the timechart command?
Sample search: index=main loglevel=error earliest=-15m | timechart span=15m
What would the rest be?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-29-2025
07:56 AM
|
Karma given to
