Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Find Answers
- :
- About m7787580
m7787580
Explorer
Member since:
12-08-2016
06-05-2020
Community Statistics
| Posts | 45 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 12-08-2016 |
Activity Feed
- Got Karma for how to replace using SED command ?. 06-05-2020 12:48 AM
- Posted Re: How do you modify your raw data in Splunk? on Splunk Search. 07-27-2018 05:50 AM
- Posted Re: How do you modify your raw data in Splunk? on Splunk Search. 07-27-2018 04:33 AM
- Posted How do you modify your raw data in Splunk? on Splunk Search. 07-27-2018 04:16 AM
- Tagged How do you modify your raw data in Splunk? on Splunk Search. 07-27-2018 04:16 AM
- Posted Re: How to change the output in this format? on Splunk Search. 07-17-2018 07:37 AM
- Posted How to change the output in this format? on Splunk Search. 07-17-2018 07:00 AM
- Posted How to count events from a same file with having two different raw text ? on Splunk Search. 01-08-2018 07:43 AM
- Tagged How to count events from a same file with having two different raw text ? on Splunk Search. 01-08-2018 07:43 AM
- Tagged How to count events from a same file with having two different raw text ? on Splunk Search. 01-08-2018 07:43 AM
- Posted Re: How to rex out and substitute it with * on Splunk Search. 09-29-2017 08:19 AM
- Posted Re: How to rex out and substitute it with * on Splunk Search. 09-29-2017 06:42 AM
- Posted How to rex out and substitute it with * on Splunk Search. 09-29-2017 04:16 AM
- Tagged How to rex out and substitute it with * on Splunk Search. 09-29-2017 04:16 AM
- Tagged How to rex out and substitute it with * on Splunk Search. 09-29-2017 04:16 AM
- Posted what to learn more along with splunk to make my profile more strong ? on #Random. 08-10-2017 10:19 PM
- Tagged what to learn more along with splunk to make my profile more strong ? on #Random. 08-10-2017 10:19 PM
- Posted Re: How to use Stats command ? on Splunk Search. 07-05-2017 01:36 AM
- Posted How to use Stats command ? on Splunk Search. 07-03-2017 08:29 AM
- Tagged How to use Stats command ? on Splunk Search. 07-03-2017 08:29 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-27-2018
04:16 AM
Hello Splunkers,
My original data looks like this for a particular day in a below example.
Currently, there are 10 entries in a day sometimes it's 4 entries and it's totally random. I would like to reshape my data as per hour and whenever there are no entries in an hour it should fill it as zero. TIME AND VALUE are the main key fields.
ORIGINAL DATA
_time TIME Value
1 2018-07-26 23:43:01.079 26-JUL-2018 00 2
2 2018-07-26 23:43:01.079 26-JUL-2018 04 2
3 2018-07-26 23:43:01.079 26-JUL-2018 06 2
4 2018-07-26 23:43:01.079 26-JUL-2018 09 2
5 2018-07-26 23:43:01.078 26-JUL-2018 12 2
6 2018-07-26 23:43:01.078 26-JUL-2018 15 3
7 2018-07-26 23:43:01.078 26-JUL-2018 16 4
8 2018-07-26 17:43:04.176 26-JUL-2018 18 2
9 2018-07-26 15:43:01.062 26-JUL-2018 21 1
10 2018-07-26 09:43:01.160 26-JUL-2018 23 1
I would like to change into per hour of raw data and fill with Zero for the time period where we don't have logs in Splunk.
REQUIRED DATA
TIME Value
1 7/26/2018 0:00 2
2 7/26/2018 1:00 0
3 7/26/2018 2:00 0
4 7/26/2018 3:00 0
5 7/26/2018 4:00 2
6 7/26/2018 5:00 0
7 7/26/2018 6:00 2
8 7/26/2018 7:00 0
9 7/26/2018 8:00 0
10 7/26/2018 9:00 2
11 7/26/2018 10:00 0
12 7/26/2018 11:00 0
13 7/26/2018 12:00 2
14 7/26/2018 13:00 0
15 7/26/2018 14:00 0
16 7/26/2018 15:00 3
17 7/26/2018 16:00 4
18 7/26/2018 17:00 0
19 7/26/2018 18:00 2
20 7/26/2018 19:00 0
21 7/26/2018 20:00 0
22 7/26/2018 21:00 1
23 7/26/2018 22:00 0
24 7/26/2018 23:00 1
Thanks in advance for your help 🙂
... View more
- Tags:
- splunk-enterprise
07-17-2018
07:00 AM
Hi Splunker,
Originally I have an output like this as a raw event in Splunk:-
2018-07-17 14:56:08 MIR="TUE, 17-JUL-2018", D_0="-", D_1="2", D_2="4", D_3="-", D_4="-", D_5="-", D_6="2", D_7="-", D_8="-
", D_9="2", D_10="-", D_11="-", D_12="-", D_13="-", D_14="-", D_15="-", D_16="-
", D_17="-", D_18="-", D_19="-", D_20="-", D_21="-", D_22="-", D_23="-
", TOTAL="10"
Where D_0 is 00:00 HR , D_1 is 01:00 HR AM,D_2 is 02:00HR AM similarly D_23 is 23:00 HR .
I would like to change it to below format:-
TIME VALUE
2018-07-17 00:00 -
2018-07-17 01:00 2
2018-07-17 02:00 4
2018-07-17 03:00 -
2018-07-17 04:00 -
Similarly, it goes on till 23:00 HR.
Thanks in advance for looking into it
... View more
- Tags:
- splunk-enterprise
01-08-2018
07:43 AM
Hi Splunker,
I have to count success and failure count from the same index and sourcetype on the basis of raw text in an event.
Only difference is that for success raw text is different and for failure raw text is different.
I have used below logic to find count of success and failure but this query is taking loads of time to execute.
Please remember these strings present below are not any field in Splunk it's a simple text on the basis of that i need to filter and count.
Could you please suggest me some other way by which i can execute this query faster.
index=Only_prod host=winter-p*-1 sourcetype="Season.log"
(Incoming OR Outgoing)
NOT ("Some String One" ) ("Some String Two" OR "Some String Three" OR "Some String Four")
|stats count as Error
|Join serviceName type=outer [
search index=Only_prod host=winter-p*-1 sourcetype="Season.log"
(Incoming OR Outgoing)
NOT ("Some String Five" ) ("Some String Seven" OR "Some String Six" OR "Some String Eight")
| stats count as Successes ]
Thanks in Advance
Regards,
... View more
09-29-2017
06:42 AM
Hi Inventsekar,
Thanks for your prompt response.
Apologies for not clearing my requirement.
When i try to use it in regex101 and use substitute inside the Regex101 website then this string is not working.
Link-->https://regex101.com/r/YPzyE7/1
... View more
09-29-2017
04:16 AM
I would like to substitute below kind of email address with *
Original :- john.trava@gmail.com
Expected:- Jo*.**va@gmail.com
First two character of first name and last two character before @ should be visible and the domain name like gmail.com should also be visible
Thanks in advace
... View more
08-10-2017
10:19 PM
what to learn more along with splunk to make my profile more strong ?
1)Any tool which can help to use Splunk more efficiently?
2)Any Programming language?
3)Any Certification ?
... View more
07-03-2017
08:29 AM
Hi Splunker,
I have a logs which has
Defect ID ,Actual Fix Time Taken,Detected By,Priority.
I would like to calculate maximum value of Actual Fix time taken by each Priority and simultaneously i would like to see the Defect Id as well
My output should look like that
Priority Defect ID Detected by Maximum Actual Fix time(In days)
P1 1234 x 2
P2 767 Y 5
P3 122 z 20
P4 3526 T 67
Note:- Actual Fix time means time taken to fix the defect and here i would like to know the Defect ID for which maximum time taken to close that defect against each priority.
I tried using below mentioned query
source="Jcaps_Logs.csv" index="jcaps" sourcetype="csv"
| fillnull value=NULL "Actual Fix Time"
| search "Actual Fix Time"!=NULL
| stats max("Actual Fix Time") as maxy by "Priority","Defect ID"
Thanks in advance
... View more
- Tags:
- max-events
- stats
06-23-2017
03:21 AM
Hi wood,
I still cannot see the fields getting extracted 😞
... View more
06-23-2017
02:50 AM
Hi Richgalloway's
I am not sure how to use spath.
If you help me in understanding the syntax and usage it would be helpfull.
Many Thanks,
... View more
06-23-2017
01:35 AM
Thanks for coming back to me.
<Na**me**>Argus</Name>
Then it is only capturing me part from Name and i want full Name to be rexed out.
Many Thanks,
... View more
06-22-2017
08:48 AM
Hi Team,
I have XML in the format present below and i am trying to use field transformation and field extraction in order to extract the field in people format.
Could you please help me in creating regular expression for this xml
<ns4:includeme>false</ns4:includeme>
<m:houseref>21</m:houseref>
<m1:security>***</m1:security>
<Name>Argus</Name>
I would like to have a single regular expression which i can use to extract all the field values and field name.
I tried to use below
- \<\w?\w?\d?\:([^\>]+)\>([^\<]+)\<\/
But its not capturing the last one Argus
So i would like to know if it can be possible if yes then what would be the expression.
Many Thanks
... View more
06-21-2017
03:52 AM
Hi DalJeanis,
Thanks for the explanation it was really help full. 🙂
... View more
06-20-2017
08:26 AM
Hi DalJeanis,
It was great stuff,queried worked absolutely fine.
Just wanted to ask one question
<(?!startTimestamp|endTimestamp)(?\w+)>(?[^<]+)<\/?\1>
--> <\/?\1> <----
What is actually doing this thing i am able to understand the whole query but not the use of this last part and 1 which you have written in the last.
Thanks again it was really awesome stuff.
Regards,
Tarun Malhotra
... View more
06-20-2017
06:11 AM
Hi Pyro_wood,
Thanks for the solution i understood.
but what if i don't want to write whole fields names again and again.
We can see that all fields are staring from < and ending on />
Can this be possible if we right single rex command like
rex field=_raw starting from <(capturing Name)>(Capturing Value)</
As we can see all the fields are following same format present below starting from < and ending on </
<ProductCode>16</ProductCode>
<JourneyOrderPoints>130</JourneyOrderPoints>
If i can have single standard rex query then i can run it on any service irrespective of any field name and value.
Thanks in advance
... View more
06-20-2017
02:34 AM
Hi Splunker,
How would like to learn how can i rex out these fields names and i don't want to rex out startTimestamp and endTimestamp in it.
<activityName>TubeSales<activityName>
<activityStatus>Play<activityStatus>
<startTimestamp>Do not want to extract<startTimestamp>
<endTimestamp>Do not want to extract<endTimestamp>
<JourneyID>3DF62A1191152ED064B039AFD2C6A81E.node-app-1<JourneyID>
<startID>C3FE7047-E9EA-78DE-D719-8D3D66EF4A1F<startID>
<JourneyOrderPointsByProductCode>
<ProductCode>16<ProductCode>
<JourneyOrderPoints>130<JourneyOrderPoints>
<JourneyOrderPointsByProductCode>
<success>
<GetRequiredJourneyOrderPointsend>
</S:Body>
Thanks in advance
... View more
- Tags:
- rex
06-20-2017
02:17 AM
Hi Pyro_wood,
What is 101010.
I am not able to understand.
Thanks in advance
... View more
06-19-2017
09:31 AM
1 Karma
Hi Splunker,
I would like to know and learn how to replace ^ns4: with <
Please find below dummy data.
^ns4:ChannelName>PublicSales
^ns4:Result>SUCCESS^/ns4:Result>
Probably here HTML tags are not visible therefore not able to provide you the exact information.
Thanks in advance
... View more
06-09-2017
09:36 AM
Yes these fields are present in multiple events i just want to rex out above mentioned fields from them.
I tried to use below mentioned search
|rex field=_raw "name\>(?<CoreOffering>[^\<]+)" max_match=50|top CoreOffering limit=0|search CoreOffering =*Core*|rex field=CoreOffering "(?\w*\s*[^\C]+)"
But is not extracting the exact field name which i want.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
