Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About jbrenner
jbrenner
Path Finder
Member since:
10-21-2016
04-07-2025
Community Statistics
| Posts | 63 |
| Solutions | 0 |
| Karma Given | 14 |
| Karma Received | 3 |
| Member Since | 10-21-2016 |
Activity Feed
- Posted How to display a trendline for distinct count of a field on Splunk Search. 04-07-2025 10:36 AM
- Karma Re: Displaying unique URIs visited per session as columns for ITWhisperer. 10-22-2024 08:06 AM
- Posted Re: Displaying unique URIs visited per session as columns on Splunk Search. 10-22-2024 08:05 AM
- Posted Re: Displaying unique URIs visited per session as columns on Splunk Search. 10-22-2024 07:59 AM
- Posted Displaying unique URIs visited per session as columns on Splunk Search. 10-22-2024 07:25 AM
- Posted Re: I want rex command to return empty string if no match on Splunk Search. 09-05-2024 06:40 AM
- Karma Re: I want rex command to return empty string if no match for ITWhisperer. 09-05-2024 06:40 AM
- Posted I want rex command to return empty string if no match on Splunk Search. 09-04-2024 08:31 AM
- Posted Filtering a weekly timewrap timechart by a specific time window each day. on Splunk Search. 03-20-2024 02:03 PM
- Posted Re: Regex that matches all characters including newline on Splunk Search. 09-28-2023 01:14 PM
- Posted Regex that matches all characters including newline on Splunk Search. 09-28-2023 11:58 AM
- Posted Excluding either the start or end of a transaction when parsing result with rex command on Splunk Search. 09-28-2023 11:51 AM
- Posted How to extract an unknown number of fields with rex command? on Splunk Search. 11-11-2022 12:47 PM
- Posted Is it possible to use two independent/unrelated queries in a timechart? on Splunk Search. 10-21-2022 12:50 PM
- Posted Re: Using Transaction command with two extracted join fields on Splunk Search. 04-19-2022 09:13 AM
- Karma Re: Using Transaction command with two extracted join fields for gcusello. 04-19-2022 09:11 AM
- Karma Re: Using Transaction command with two extracted join fields for gcusello. 04-19-2022 09:10 AM
- Posted How to use Transaction command with two extracted join fields? on Splunk Search. 04-19-2022 08:18 AM
- Karma Re: Which timestamp is used when piping a transaction result into timechart command for diogofgm. 01-24-2022 01:36 PM
- Karma Re: Which timestamp is used when piping a transaction result into timechart command for johnhuang. 01-24-2022 01:36 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-07-2025
10:36 AM
I want to add a trendline to this chart: index=my_index
| timechart dc(USER) as DISTINCT_USERS How do I accomplish this? Thanks! Jonathan
... View more
Labels
- Labels:
-
timechart
10-22-2024
08:05 AM
Exactly what I needed. Thanks!
... View more
10-22-2024
07:59 AM
My search returns something like this: SESSION URI b4db1013-e31d-4df5-94ed-3b5b2fc0dc1f Page1.html b4db1013-e31d-4df5-94ed-3b5b2fc0dc1f Page2.html b4db1013-e31d-4df5-94ed-3b5b2fc0dc1f Page3.html 42b772ff-b142-471c-a780-080261b084a0 Page2.html 42b772ff-b142-471c-a780-080261b084a0 Page1.html 42b772ff-b142-471c-a780-080261b084a0 Page4.html 42b772ff-b142-471c-a780-080261b084a0 Page5.html 5136941f-a2e7-4c39-83bd-bd5d2709fb18 Page3.html 5136941f-a2e7-4c39-83bd-bd5d2709fb18 Page1.html And I'd like to transform the results into this (preserving the sort sequence): SESSION URI b4db1013-e31d-4df5-94ed-3b5b2fc0dc1f Page1.html, Page2.html, Page3.html 42b772ff-b142-471c-a780-080261b084a0 Page2.html, Page1.html, Page4.html, Page5.html 5136941f-a2e7-4c39-83bd-bd5d2709fb18 Page3.html, Page1.html We can either concatenate the URIs into the same field (as in this example), or we can create a separate column for each URI, whichever is easier. Thanks!
... View more
10-22-2024
07:25 AM
I have a splunk search that returns two columns, SESSION and URI. How can I show the sequence of URIs visited by each SESSION as columns, with a separate row for each SESSION? Thanks!
... View more
09-05-2024
06:40 AM
Exactly what I needed. Thanks!
... View more
09-04-2024
08:31 AM
Let's say I have the following SPL query. Ignore the regexes, thery're not important for the example: index=abc
| rex field=MESSAGE "aaa(?<FIELD1>bbb)"
| rex field=MESSAGE "ccc(?<FIELD2>ddd)"
stats count by FIELD1, FIELD2 Right now, the query doesn't return a result unless both fields match, but I still want to return a result if only one field matches. I just want to return an empty string in the field that doesn't match. Is there a way to do this? Thanks!
... View more
03-20-2024
02:03 PM
I have the following query that gives me week-over-week comparisons for the past month: index="myIndex" earliest=-1mon "my query" | timechart count as Visits | timewrap w I have added dropdowns to my dashboard to filter this data by a user-selected time window for every day in the one month range. The four dropdowns correspond to the start hour, start minute, end hour, and end minute of the time window in military time. For example, to filter the data by 6:30 AM - 1:21 PM each day, the tokens would have the following values: $start_hour_token$: '6'
$start_minute_token$: '30'
$end_hour_token$: '13'
$end_minute_token$: '21' How would I modify the original query to make ths work? Thanks! Jonathan
... View more
Labels
- Labels:
-
timechart
09-28-2023
01:14 PM
Thanks, ITWhisperer. Perhaps I didn't ask my question clearly enough. I was looking for something like this: [\S\s\n\t\r\n\f.]+ It may be redundant, but it seems to work.
... View more
- Tags:
- than
09-28-2023
11:58 AM
What's the simplest regex that will match any character including newline? I want to be able to match all unknown content between two very specific capture groups. Thanks! Jonathan
... View more
Labels
- Labels:
-
regex
09-28-2023
11:51 AM
I'm using the rex command to parse a value out of the results of a transaction command. Is there an easy way to restrict the resulting capture from searching either the start or end block of the transaction? This would be much easier than doing it in the regex itself, since both blocks of text returned are very similar. Thanks! Jonathan
... View more
Labels
- Labels:
-
rex
-
transaction
11-11-2022
12:47 PM
Let's say I have data in an event that looks like this:
NAME: John
NAME: Mary
NAME: Sue
Assuming I have no idea how many names will exist in the event, is it possible to use the rex command to parse out all the names and display them in separate fields?
Thanks,
Jonathan
... View more
Labels
- Labels:
-
rex
10-21-2022
12:50 PM
I have two independent/unrelated queries (same index, though) , and I want to create a timechart where there are two bars in each time bucket, one for each of the two queries. Is this possible?
Thanks!
Jonathan
... View more
Labels
- Labels:
-
chart
04-19-2022
09:13 AM
@gcusello Thanks Giuseppe! Worked like a charm! I originally considered your alternative solution, but this is a one-off scenario, and it's unlikely we will ever use these extracted fields again.
... View more
04-19-2022
08:18 AM
I have two Splunk queries, each of which uses the _rex command to extract the join field.
Example:
QUERY 1
index=index1 "Query1" | rex field=_raw "abc(?<MY_JOIN_FIELD>def)"
QUERY 2
index=index2 "Query2" | rex field=_raw "ghi(?<MY_JOIN_FIELD>jkl)"
I want to use the Transaction command to correlate these two queries, but I can't figure out how to do it.
Thanks!
Jonathan
... View more
Labels
- Labels:
-
transaction
01-21-2022
01:59 PM
I have a transaction command which correlates two log entries. If I pipe this result into a timechart command, which log entry's timestamp does it use to bucketize the results (the first or the second)? Also, is there a way to specify this? Thanks! Jonathan
... View more
Labels
- Labels:
-
timechart
-
transaction
01-21-2022
01:29 PM
I have a Splunk query that does a lot of computation and eventually returns only two calculated fields: _time and STORE_ID via the table command. The _time field is formatted exactly like the the built-in _time field (e.g., "2022-01-17 23:50:25,897"). I want to do a timechart showing the count of how many times each unique STORE_ID appears in a given time bucket, using my calculated _time variable to fill the buckets. What do I put in the timechart clause to accomplish this? Thanks! Jonathan
... View more
Labels
- Labels:
-
timechart
04-23-2021
01:45 PM
I forgot to mention that I don't know how many times LoginCount will appear in any particular log statement. The number of instances will vary.
... View more
04-23-2021
01:43 PM
I have a pattern of text that appears in a log statement multiple times. Here is an example: RandomStuff|LoginCount=5|RandomStuff|LoginCount=3|More RandomStuff|LoginCount=4|YetMoreRandomStuff How can I use the rex command to get a sum of all the LoginCount values (which would total 12 in this example)? Thanks! Jonathan
... View more
- Tags:
- rex
06-27-2019
07:17 AM
index=my_index earliest=-1mon "Order Submitted" |
timechart count(IP) as SuccessfulOrders
... View more
06-27-2019
06:43 AM
I am using the timechart command to create a graph with one bar for each day in the month, and I would like each day of the week to display in the same color, so I can easily identify week-over-week changes.
For example, Mondays would be blue, Tuesdays would be green, etc.
Is this possible?
Thanks in advance!
Jonathan
... View more
07-18-2018
12:51 PM
1 Karma
I'm using the bin command to get a distribution of values, and each grouping is in increments of 10,000.
I have a few outliers way at the upper end, and I don't want to see all the empty buckets in the middle. Is it possible to put all values above a desingated cutoff value into the final bin?
Thanks,
Jonathan
... View more
- Tags:
- bin
- splunk-enterprise
06-14-2018
12:55 PM
Hi,
I don't know what I was doing wrong, but after trying some different things, it stopped stripping out the escape characters.
I think I must have doing something wrong in the UI.
To answer your question, though, I was selecting the dropdown that says "Event Actions" and selecting "Extract Fields"
Thanks for responding,
Jonathan
... View more
06-14-2018
11:19 AM
Sorry. meant to say "backslash," not "backspace" 🙂
... View more
06-14-2018
11:17 AM
I'm creating an extracted field using a regex, and I want to use a literal pipe "|" character in the regex.
My understanding is to use a backspace as an escape character as follows:
\|
When I save the regex and return to it, however, the backslash has been removed.
What am I doing wrong?
Thanks,
Jonathan
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-07-2025
12:25 PM
|
Karma given to
