For the following log, I would like to filter by a string. I would have to extract the string using regex. traceId=xyz msg=Patch for deviceId with body {"parameters":[{"value":"{\"code\":\"ABC_DEF_SEND_MACBOOKS\",\"commands\.....} traceId=xyz msg=Patch for deviceId with body {"parameters":[{"value":"{\"code\":\"ABC_DEF_OPEN_MACBOOKS\",\"commands\.....} My Splunk query is as follows. host=* sourcetype="*" source="example.log" "msg=Patch for deviceId*" | rex "code\\"\:\\"(?<codes>.{20})" | where codes=ABC_DEF_SEND_MACBOOKS But splunk throws the below error related to regex Error in 'rex' command: Encountered the following error while compiling the regex 'code\\:\(?<codes>.{20})': Regex: unmatched closing parenthesis When I checked the regex in regex101.com, the output for codes is as expected. What is wrong with the parenthesis in this case? ... View more

I have the following log sets, one for success case and one for the failure case Success: id=11111 msg=Begin process... id=11111 msg=check id=11111 msg=Success... failure: id=22222 msg=Begin process... id=22222 msg=check id=22222 msg=Fail... Here I want to check the time between the events using the transaction. host=* sourcetype=** source="*/example.log" "Begin process*" OR "Success*" | transaction traceId startswith="Begin process" endswith="Success" | table traceId duration _time Above query will give me the transactions of a success case only. Can we use AND Operator in the endswith so that I can check the duration between events irrespective of it being a success or failure? ... View more

I'm calculating the time difference between two events by using Transaction and Duration. Below is the query that I used to get the duration between two events Model and Response host=* sourcetype=** source="*/example.log" "Model*" OR "Response*" | transaction traceId startswith="Model" endswith="Response" | table traceId duration _time I want to get counts of transactions where duration>1, duration<1 and the total count in the same table. I was able to do it individually in separate queries using where clause and eval. But was not successful when I combined them. The individual query that works for me is "Model List*" OR "Response Code*" | transaction traceId startswith="Model List" endswith="Response Code" | eval less_dur=duration | where less_dur > 1 | stats count(less_dur) Query that doesnt work me is "Model List*" OR "Response Code*" | transaction traceId startswith="Model List" endswith="Response Code" | eval less_dur=duration | where less_dur > 1 | eval more_dur=duration | where more_dur < 1 | stats count(less_dur), count(more_dur), count ... View more

I'm calculating the time difference between two events by using Transaction and Duration . Below is the query that I used to get the duration between two events Model and Response host=* sourcetype=** source="*/example.log" "Model*" OR "Response*" | transaction traceId startswith="Model" endswith="Response" | eval dur=duration | eval time_taken=tostring(dur,"duration") | table traceId time_taken _time And the result would be similar to traceId | time_take | _time trace_1681692777 | 00:00:0.451 | 2019-07-03 15:52:02.537 trace_1681692779 | 00:00:1.921 | 2019-07-03 15:55:00.129 trace_1681692780 | 00:00:3.981 | 2019-07-03 15:59:01.754 Using the above data, I want to get the max, min and avg time_taken values. I tried using stats min(dur) as min, etc and eval but was not successful. How do I achieve this? ... View more

Hello, I have the following logs: 2019-05-30 14:39:00,115 traceId=AAAAAA msg=Incoming with body {"parameters":[{"dataType":0,"value":"{\"code\":\"OPEN\",....}...}]} 2019-05-30 14:43:56,778 INFO traceId=AAAAAA msg=Json Object Before n .. MqttMessageModel [sessionId=111, code=SENT, ...] And I would like to get the time difference between these two events/logs. I need to know the difference depending on the code . As the code changes from OPEN to SENT, how long did it take? In an ideal scenario if I had correct logs I would use the following. But in my case how can I get the time difference between the events? host=host" source="source" code="OPEN" OR code="SENT" | transaction traceId startswith=OPEN endswith=SENT | table duration _time traceId ... View more