it worked ... View more

hi @jw44250 IFor Splunk 6.5 you can perform individual Panel refresh instead of the entire dashboard: <refresh>2m</refresh> <refreshType>delay</refreshType> <option name="refresh.display">preview</option> Other options for "refresh.display" With any version of Splunk, <dashboard refresh="30"> ... View more

@jw44250 , as mentioned above replace() uses regular expression. If you would notice based on your sample data I have added \w+ for Machine name with word characters. You can change regular expression based on Regular Expression pattern of data before and after JSON. If you are not able to figure out the regular expression yourself, you will have to provide some sample events of data before and after JSON. (Start and End of JSON can also be used for Regular Expression match). ... View more

Hello, If you try this: | makeresults | eval _raw="\"serialNumber\":\"test1234\",\"serviceChannel\":\"test\",\"countryOfPurchase\":\"US\"" | rex field=_raw "\"serialNumber\":\"(?<serialNumber>\w*)" | table serialNumber In any case you can use Field Extractor UI http://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/ExtractfieldsinteractivelywithIFX ... View more

If you want white space on either end, then you need anchors. Try (?i)^\s+error\s+$ . ... View more

1) With that rex , you should only get the first one. ( max_match defaults to 1) This is assuming that the rex contains a field name in angle brackets <> . Please mark your code - either with the 101 010 button or the grave accent (to the left of the 1 on a standard US keyboard) before and after it to prevent the interface from obeying or stripping out things that look like HTML formatting commands. For large pieces of code, you can also just make sure there are at least four spaces at the beginning of each line. |rex field=_raw "\s(?<myExcp>(java|javax).\w+.\w+Exception)" 2) If the sourcetype is set to extract KV, you will get all of them. ... View more

I do not understand the way that you have presented your data. I also do not understand the desire. It helps greatly if you present sample raw events and desired output mockup. ... View more

Splunk Version 6.5.2.1 ... View more

thanks -- sorry been busy with wrk ... View more

Thank you ... View more

OK, be sure to 'UpVote' everyone and click Accept to close the question. ... View more

Try this index=index1 | rex field=requestURl \w+\/test(?<error>Error) | fields error ... View more

No you can't. YOu can't assign a field name to a string. You would need to have it extracted (like option 2) before you could use it. ... View more

/0960P011.png /0l76F0VE.pfg /1/ ... View more

For your last question can you let me know what is the output you want when digits are replaced? The reason why I am asking is because martin_mueller has already given you a query to remove digits from URL. So please provide the expected output for the following: input= localhost/employees/100/comments output=? ... View more

let me tried it..thanks ... View more

Thanks it worked.. actually I did exactly.. Now i'm facing this issue how extract another event from the same log file and a called yourfieldname 2 rex "(?exception\s\w+\s\w+)" yourfieldname 1 rex "(?Message\s\w+\s\w+)" yourfieldname 2 but if i use pipe it will not works. extracting multiple fields from the same index but differnet events message 1 event1 message 2 event 2 etc ... View more

Hi Thanks... i was not sure about max_match..not getting all the appIds. I want to do something like this: IndexList AppId Http URL Http Method . totalHit index1 100 . employee/12 GET 10 index2 100 . url/employee POST 2 index3 200 . url put 30 Log files example index=index1 2017-04-08, logger="test1, AppId="100",", httpPort="8443", accept="", contentType="application/json", requestURI="/employees", httpMethod="POST", 2017-04-03, logger="test1, AppId="100",", httpPort="8443", accept="", contentType="application/json", requestURI="/employees", httpMethod="POST", 2017-04-02, logger="test1, AppId="100",", httpPort="8443", accept="", contentType="application/json", requestURI="/employees", httpMethod="POST", index=index2 2017-03-03, logger="test2", AppId="200",", , accept="", contentType="application/json", requestURI="/employee/1234", httpMethod="GET", index=index3 2017-02-01, logger="test1, AppId="300",", httpPort="8443", accept="", contentType="application/json", contentLength="267", requestURI="/employee/create", httpMethod="PUT", ... View more

| rex "clientAppId(?[^=]+)" | stats count by appId host | rex "clientAppId=(?\d+)" | stats count by appId host i am not getting any result ... View more

This works: |rex field=_raw "\s(?<a_exceptiontype>(java|javax)\.\w+\.\w+Exception)" Tested. ... View more

really good blog post thank you -- how to exclude the word exception from below query this splunk query index = index Exception | rex ".?(?(?:\w+.)+\w?Exception).*" | stats count by exception result : Uncaught exception: no Access Rule found for key --- java.lang.exception .. this query catches the word exception as well but i'm not interested in work exception -- i am interested the following java.io.IOException java.lang.Exception java.lang.IllegalAccessException java.lang.reflect.InvocationTargetException java.lang.RuntimeException java.net.ConnectException, java.net.SocketException java.rmi.NoSuchObjectException java.util.MissingResourceException javax.ejb.NoSuchEJBException javax.faces.application.ViewExpiredException javax.faces.FacesException ... View more

@jw44250 - To add to richgalloway's comment, the more information and context you can provide to the Answers community, the better chances you have of another user providing a working solution to your question. It would be helpful if you provided your current search so that experts in the community have a starting point in order help you out. ... View more

still the total count for exception is not correct -- i want to use IN operator something like this index=index* . EXception IN(NPE, SQLNotFOund, FILE) |stats count by exception... The query does but its counts all the exception which is the same log...i am not interest the word exception at all ... View more

Yes..thanks from everyone...sorry been busy with work.. ... View more

Hi jw4425, Your rex syntax seems incorrect. A field name should be provided to which to assign the captured group, something like this: ... | rex ".*(?<new_field_name>+\w*?Exception).*" For details, see http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Rex. Hope this helps. Thanks! Hunter ... View more