About priyankamundarg

priyankamundarg · ‎09-23-2016

It worked perfectly. Thank you so much

priyankamundarg · ‎09-22-2016

I did not get. Can you please send it again?

priyankamundarg · ‎09-22-2016

To extract /Folder1/Folder2/Folder3/Folder4/Folder5/LoadABCDEF_20160921.log Try this: | rex field=source "(?[A-Za-z]+_[0-9]+).log" it will only extract the last filename as long as it is written in "alphabet_numeric.log" format This is definitely working. But how to ignore displaying of date format after ""?I want to display only "LoadABCDEF". and ther is one more "" inbetween the path like Folder_3.

priyankamundarg · ‎09-22-2016

How to ignore "_" in tha path. Few \/(?\w+[0|1]_\w+)\/w+\/ kind is not working. Please help me with that. Because value can be "OrderOnline_ABCD" or "OrderOnlineABCD". the current rex is ignoring "OrderOnlineABCD"

priyankamundarg · ‎09-22-2016

How to give 0 or 1 condition for ""? "" may or may not be there in the path. Like "OrderOnline_ABCD" may have "OrderOnlineABCD" value. this value is gettimg ignored. [0|1] OR [0,1] doesn't work here? \/(?\w+[0|1]_\w+)\/w+\/ its is not working. Kindly help

priyankamundarg · ‎09-22-2016

actually Folder3 is like Folder_3. is it breaking there?

priyankamundarg · ‎09-22-2016

Thank you for the quich response. For below /Folder1/Folder2/Folder3/OrderOnline_ABCD/Folder4/ path I would like to fetch "OrderOnline_ABCD" from the source. | rex field=source "\/(?\w+_\w+)\/" | table sourceRex its giving sourceRex value as Folder3. Can u please elaborate how its working?

priyankamundarg · ‎09-22-2016

My source filed has value such as, /Folder1/Folder2/Folder3/Folder4/Folder5/LoadABCDEF_20160921.log I would like to extract the "LoadABCDEF" from the source. Similarly /Folder1/Folder2/Folder3/OrderOnline_ABCD/Folder4/ path I would like to fetch "OrderOnline_ABCD" from the source. can someone help me how to fetch the application name from the source? | rex field=source "*"

priyankamundarg · ‎08-03-2016

I tried this way. When status is changed from PENDING to ACCEPTED the cust id still remains in the panel. It will not vanish.

priyankamundarg · ‎08-03-2016

In a log file I have one field with name EVENT_STATUS. It has 3 values 1.Accepted 2. Pending 3. Rejected I have designed a dashboard to track the Status of Customer ID.(Initially it will be Pending. once administration approves it then its changed to Accepted) I would like to display those customer ID which are in Pending status. Once the pending state is changed to Accepted it should go away from the Panel. index=* source=* EVENT_STATUS="*" Cust_ID | where EVENT_STATUS="PENDING" OR EVENT_STATUS="REJECTED"|search latest(EVENT_STATUS)| table Cust_ID , Cust_NAME ,EVENT_STATUS , EVENT_TIME. Please specify the correct query.

priyankamundarg · ‎08-02-2016

Kindly help me with crontab schedule and Trigger Conditions. Am confused in that part. If string matches what should be the trigger condition?

Posts	11
Solutions	0
Karma Given	3
Karma Received	0
Member Since	‎08-02-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Rex for Source

How to display Event_Status change?

i am looking for a particular string match in a lo...

Re: Rex for Source

Re: Rex for Source

Re: Rex for Source

Re: Rex for Source

Re: Rex for Source

Re: Rex for Source

Re: Rex for Source

Rex for Source

Re: How to display Event_Status change?

How to display Event_Status change?

i am looking for a particular string match in a lo...

Are you a member of the Splunk Community?