Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About hamishcross
hamishcross
Engager
Member since:
08-05-2019
12-13-2022
Community Statistics
| Posts | 7 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 08-05-2019 |
Activity Feed
- Posted Re: Need help extracting multiple fields from a search result on Splunk Search. 12-09-2022 03:30 AM
- Posted How to extract multiple fields from a search result? on Splunk Search. 12-07-2022 10:18 PM
- Karma Re: Help with splunk query, searchmatch finding false positives for FrankVl. 06-05-2020 12:50 AM
- Posted Re: How to sum values from specific rows to then display in pie graph on Splunk Search. 08-06-2019 10:22 PM
- Posted Re: Help with splunk query, searchmatch finding false positives on Splunk Search. 08-06-2019 06:07 PM
- Posted Re: Help with splunk query, searchmatch finding false positives on Splunk Search. 08-05-2019 10:07 PM
- Posted How to sum values from specific rows to then display in pie graph on Splunk Search. 08-05-2019 10:05 PM
- Tagged How to sum values from specific rows to then display in pie graph on Splunk Search. 08-05-2019 10:05 PM
- Tagged How to sum values from specific rows to then display in pie graph on Splunk Search. 08-05-2019 10:05 PM
- Tagged How to sum values from specific rows to then display in pie graph on Splunk Search. 08-05-2019 10:05 PM
- Posted Help with splunk query, searchmatch finding false positives on Splunk Search. 08-05-2019 12:20 AM
- Tagged Help with splunk query, searchmatch finding false positives on Splunk Search. 08-05-2019 12:20 AM
- Tagged Help with splunk query, searchmatch finding false positives on Splunk Search. 08-05-2019 12:20 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
12-09-2022
03:30 AM
So my aim is to execute the below, which should tally up the number of events that a given "context" has executed, and subsequently logged. This context(id) is another name for a session. index=myindex ("events") OR ("events2") | rex "context.{3}\"(?<context>.[a-zA-Z0-9_:-]+)" | stats count by context I'd then like to tie join the above context on the below, so that I can get user details related to above results index=myindex ("\"login\"\,\"context\"") AND ("username") | rex "context\":\s\"(?<context>[^\"]*)\".*?\"userid\"+:\s\"(?<userid>[^\"]*)\".*?\"username\"+:\s\"(?<username>[^\"]*)\".*?\"groupid\"+:\s\"(?<groupid>[^\"]*)" | table context userid groupid username I'd then like to only show unique rows based on the userid And finally, I'd then like to be able to show a count of the unique rows above
... View more
12-07-2022
10:18 PM
Hi All
I am trying to extract the values that trail context, userid, username, groupid
Sample partial event
{ "type": "login","context": "Rsomeserver:8877-T1670321752-P18407-T030-C000025-S38","sequence": 998,"message": { "state": "ok","agent": true,"userid": "User0000000949","loginid": "somelogin101","ownerid": "system","username": "John Smith","cssurl": "[\"/css/somepage.css\",\"/branding/\"]","groupid": "Group0000000945","windows": [ {"name":"something","id":"someid","url":"/someurl//
I started with this approach
"context": "(?<SessionID>[^\"]*)".*?"username"+: "(?<Username>[^\"]*)"
And this seems to compile on regex101 but on rex it's throwing an error
Error in 'SearchParser': Missing a search command before '^'. Error at position '141' of search query 'search index=<removed> ("\"login\"\,\"contex...{snipped} {errorcontext = ?<userid>[^\"]*)"}'.
My aim is to then use this data to join on the context value with another search, but I'm looking for help on where I'm going wrong with my Rex.
As the JSON seems to be truncated, I don't think I can treat it as JSON, so any help with a REX extraction would be greatly appreciated.
... View more
Labels
- Labels:
-
rex
08-06-2019
10:22 PM
I'm pretty sure you're missing a stats ahead of the sum?
... View more
08-06-2019
06:07 PM
Awesome! For newbies like me, if it doesn't work, finding the problem can be really problematic. So really good to ensure the examples work. Thanks again
... View more
08-05-2019
10:07 PM
Thanks mate, that worked pretty well. Only thing I would say is I had to remove the "index=my_app" after rex to make it work. Was this in error or have I made a mistake?
... View more
08-05-2019
10:05 PM
Hey guys,
I'm trying to add the values that correspond to specific rows in a search, to then display on a dashboard (graph/pie graph).
For example, I have a table that returns as below:
Scenario count
"C2C Scenario 1" 1
"C2C Scenario 2" 2
"C2C Scenario 3" 3
"C2C Scenario 4N" 4
"C2C Scenario 4Y" 5
"C2C Scenario 5" 6
"C2C Scenario 6" 10
The above is currently returned using the below
index=ivr_app ("C4C Scenario")| rex "C2C Scenario (? \w+)" | eval Scenario = "C2C Scenario"." ".Reason | stats count by Scenario
I want to have a sum of the count
"C2C Scenario 2" + "C2C Scenario 4Y" + "C2C Scenario 5" as "POSITIVE"
"C2C Scenario 1" + "C2C Scenario 3" + C2C Scenario 4N" + "C2C Scenario 6" as "NEGATIVE"
So end outcome would be a table that is
Scenario sum
POSITIVE 11
NEGATIVE 18
The plan will then be to display the above in a pie graph.
Any help would be greatly appreciated! Thanks again. Loving getting into this stuff but starting off a little slow.
... View more
08-05-2019
12:20 AM
Hey All,
Very new to using splunk and love the power of dashboards.
I'm executing the following
index=my_app ("C4C Auth Scenario")| stats count(eval(searchmatch("C4C Auth Scenario 1"))) as "S1", count(eval(searchmatch("C4C Auth Scenario 2"))) as "S2", count(eval(searchmatch("C4C Auth Scenario 3"))) as "S3", count(eval(searchmatch("C4C Auth Scenario 4Y"))) as "S4Y", count(eval(searchmatch("C4C Auth Scenario 4N"))) as "S4N", count(eval(searchmatch("C4C Auth Scenario 5"))) as "S5", count(eval(searchmatch("C4C Auth Scenario 6"))) as "S6" | untable blank Reason Count | table Reason Count
And I'm finding that S6 is returning false positives.
If I execute index=my_app "C4C Auth Scenario 6" no results are returned.
Yet if I execute the full query above, it returns multiple rows in the count
What would the cause of this be, and how do I go about ensuring it doesn't occur.
I'm looking to create a dashboard based on the occurrence of logging events.
Any help would be greatly appreciated.
... View more
