Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About harshparikhxlrd
harshparikhxlrd
Path Finder
Member since:
10-31-2019
06-05-2020
Community Statistics
| Posts | 43 |
| Solutions | 3 |
| Karma Given | 4 |
| Karma Received | 2 |
| Member Since | 10-31-2019 |
Activity Feed
- Karma Re: Why is rex not extracting all data (limitation on data extraction?) for to4kawa. 06-05-2020 12:51 AM
- Karma Re: How to add a column to a stats table using rex for gcusello. 06-05-2020 12:50 AM
- Karma Re: Help removing strings after a certain string with Rex for woodcock. 06-05-2020 12:50 AM
- Karma Re: Using Rex command to extract time duration in hh:mm:ss for marycordova. 06-05-2020 12:50 AM
- Got Karma for Search is waiting for input ERROR. 06-05-2020 12:50 AM
- Got Karma for Changing the order that bars appear in bar graph. 06-05-2020 12:50 AM
- Posted Re: Converting extracted information to 12 hour AM/PM format on Splunk Search. 02-11-2020 07:07 AM
- Posted Converting extracted information to 12 hour AM/PM format on Splunk Search. 02-11-2020 06:33 AM
- Tagged Converting extracted information to 12 hour AM/PM format on Splunk Search. 02-11-2020 06:33 AM
- Posted Re: Time, Duration, not showing up on Dashboard on Dashboards & Visualizations. 01-27-2020 08:59 AM
- Posted Re: Time, Duration, not showing up on Dashboard on Dashboards & Visualizations. 01-23-2020 01:37 PM
- Posted Re: Time, Duration, not showing up on Dashboard on Dashboards & Visualizations. 01-23-2020 01:37 PM
- Posted Re: Time, Duration, not showing up on Dashboard on Dashboards & Visualizations. 01-23-2020 01:32 PM
- Posted Re: Time, Duration, not showing up on Dashboard on Dashboards & Visualizations. 01-23-2020 01:31 PM
- Posted Time, Duration, not showing up on Dashboard on Dashboards & Visualizations. 01-23-2020 11:48 AM
- Tagged Time, Duration, not showing up on Dashboard on Dashboards & Visualizations. 01-23-2020 11:48 AM
- Posted Re: Why is rex not extracting all data (limitation on data extraction?) on Splunk Dev. 01-15-2020 01:54 PM
- Posted Re: Extracting up to a particular string in rex on Splunk Dev. 01-15-2020 01:48 PM
- Posted Re: Why is rex not extracting all data (limitation on data extraction?) on Splunk Dev. 01-15-2020 01:45 PM
- Posted Re: Why is rex not extracting all data (limitation on data extraction?) on Splunk Dev. 01-15-2020 01:39 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
04-18-2023
11:10 PM
@aberkow wrote: Otherwise fillnull value=0 should fill any fields that are null. Works for me.
... View more
02-11-2020
07:07 AM
Whoa, that worked. I just had to change the "Start Time" to startTime to match my query, but this is perfect and simple. Thank you!! I never thought to try a strptime within a strftime.
... View more
01-27-2020
08:59 AM
I managed to resolve the issue on my own. It ended up being due to how I was extracted the data. I took the "index=monitoring" line, deleted the departments and makes that a rex command. I rex search for department name and then manually input everything else. Test was successful.
... View more
01-15-2020
02:07 PM
\s (lower case) is white space.
\S (upper case) is anything that is not white space.
Put them together and you match anything.
... View more
01-15-2020
01:48 PM
This was my issue. I also found that my other issue I had was a result of using the . operator.
| rex field=Message "Message=\"(?<msg>[\s\S]*)\" AdditionalInfo1"
The dot operator doesn't consider spaces, which was causing an issue in my data. Thank you though.
... View more
01-03-2020
09:01 AM
Be careful with the use of the question mark when extracting, because you may not get everything you expect. Take a look in the posts with the rex or regex tags for great examples. One very useful tactic is to use the not-match. If you know the item you seek is followed by a comma, then match everything that is not a comma, which would be: (?<ex>[^,]+)
This is often much more effective than trying to define everything that does belong in the character class, if you simply know what doesn't belong.
... View more
12-31-2019
08:17 AM
1 Karma
Hi
I guess it's not possible without css, you can try with the following
<dashboard>
<label>chart</label>
<row depends="$hide$">
<panel>
<html>
<style>
#rk g[class="highcharts-axis-labels highcharts-xaxis-labels "] text{
font-weight:bold !important;
}
</style>
</html>
</panel>
</row>
<row>
<panel>
<chart id="rk">
<search>
<query>index=_internal | timechart count by sourcetype</query>
<earliest>-7d@h</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">column</option>
<option name="charting.drilldown">none</option>
</chart>
</panel>
</row>
</dashboard>
... View more
12-24-2019
08:45 AM
Resolved issue. Was simply just a spacing issue with Duration: not properly being aligned.
... View more
12-23-2019
02:34 PM
So somebody changed the filename in there somewhere; try this:
index="monitoring" AND sourcetype="PEGA:WinEventLog:Application" AND (SourceName="RoboticLogging" OR SourceName="Application") AND (Type= "Information") AND ("TaskID=\"Logs\"") AND ("Department="CCC Sales"")
| rex field=_raw "Automation=\"(?<Auto>.+?)\""
| where Auto = "DA_E_SMDLogTime" OR Auto = "DA_E_AuditLog" OR Auto = "DA_E_AfterCallAuditLog"
| rex "Message=\"(?<log>.+?)\""
| timechart count by log
| rename AppsLog AS "Start My Day", CalltrackerLog AS "Sales Tracker", QMLog AS "Queue Manager"
| eval "Reset My Call" = coalesce(ResetMycallLog, ResetMyCallLog)
| fields - ResetMycallLog, ResetMyCallLog
| eval Time = strftime(_time, "%d %b")
| fields - _time
| table Time "Start My Day", "Sales Tracker", "Queue Manager", "Reset My Call"
... View more
12-19-2019
08:00 AM
Splunk Enterprise on the cloud. I'm not sure what version number, but that's what I'm using
... View more
12-18-2019
12:37 PM
Try this.
| eval dur = hh."hr ".mm."min ".ss."sec"
| rex field=dur mode=sed "s/0hr (.*)/\1/"
... View more
12-05-2019
11:09 AM
1 Karma
@harshparikhxlrd for reversing the legend order, you would need to play a bit with the CSS override, provided you have fixed series which as per your example is 4. You can refer to following answer where I have explained how to pick the CSS selector for Chart Legend: https://answers.splunk.com/answers/587506/why-are-the-legend-and-stacking-order-of-this-bar.html
Following is the CSS you should try where chart1 is the id of the chart where CSS override needs to be applied i.e. <chart id="chart1">
<html depends="$alwaysHideCSSStyle$">
<style>
#chart1 .highcharts-legend-item.highcharts-series-3{
transform:translate(10px,3px) !important;
}
#chart1 .highcharts-legend-item.highcharts-series-2{
transform:translate(130px,3px) !important;
}
#chart1 .highcharts-legend-item.highcharts-series-1{
transform:translate(250px,3px) !important;
}
#chart1 .highcharts-legend-item.highcharts-series-0{
transform:translate(360px,3px) !important;
}
</style>
</html>
Following is the run anywhere example to show the comparison of the two charts, First one with CSS override and second one with original Legend placement.
Following is the complete Simple XML Code for run anywhere example:
<dashboard>
<label>Reverse Legend Sorting order</label>
<row>
<panel>
<html depends="$alwaysHideCSSStyle$">
<style>
#chart1 .highcharts-legend-item.highcharts-series-3{
transform:translate(10px,3px) !important;
}
#chart1 .highcharts-legend-item.highcharts-series-2{
transform:translate(130px,3px) !important;
}
#chart1 .highcharts-legend-item.highcharts-series-1{
transform:translate(250px,3px) !important;
}
#chart1 .highcharts-legend-item.highcharts-series-0{
transform:translate(360px,3px) !important;
}
</style>
</html>
<chart id="chart1">
<title>Chart with CSS override for Legend position adjustment</title>
<search id="bHostCnt">
<query>| makeresults count=9
| fields - _time
| eval counter=1
| accum counter
| eval host="host"."0".counter
| fields - counter
| eval "Start My Day"=random(), "Sales Tracker"=random(), "Queue Manager"=random(), "Reset My Call"=random()
| foreach "Start My Day", "Sales Tracker", "Queue Manager", "Reset My Call"
[| eval <<FIELD>>=substr('<<FIELD>>',1,3)]
| table host *</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">bar</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">bottom</option>
<option name="charting.lineWidth">2</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</chart>
<chart id="chart2">
<title>Chart without CSS override for Legend position adjustment</title>
<search base="bHostCnt">
<query></query>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">bar</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">bottom</option>
<option name="charting.lineWidth">2</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</chart>
</panel>
</row>
</dashboard>
... View more
12-02-2019
09:22 AM
1 Karma
Greetings @harshparikhxlrd,
You are rounding in this line: | eval dur = round(((hh * 3600) + (mm * 60) + ss),2) , but then you take another average on this line: | stats avg(dur) as "Average Duration" by log, strr which will sometimes give repeating decimals.
You just need to round after the last average instead of before it, so your query should look more like this:
index=monitoring sourcetype=PEGA:WinEventLog:Application (SourceName="RoboticLogging" OR SourceName="Application") (Type= "Information") ("TaskID=\"Logs\"")
| rex "Automation=\"(?<Auto>.+?)\""
| where Auto = "SDA_E_AuditLog"
| rex "Message=\"(?<log>.+?)\""
| rex "Duration:(?<hh>\d+):(?<mm>\d+):(?<ss>\d+\.\d+)"
| eval dur = (hh * 3600) + (mm * 60) + ss
| rex "UserID=\"UNTOPR\\\(?<UID>.+?)\""
| eval User = host." : ".UID
| stats avg(dur) as "Average Duration" by log, User
| eval "Average Duration" = round('Average Duration',2)
| stats list(log) as Automation list("Average Duration") as "Average Duration (seconds)" by User
| table User Automation "Average Duration (seconds)"
Cheers,
Jacob
... View more
12-03-2019
08:38 AM
Resolved my issue. It was simply because the index was set to "monitoring", but did not take into account "windows." I simply added OR index="windows" to my query and it pulled the data correctly.
... View more
01-19-2020
02:43 AM
| makeresults
| eval _raw="11/05/2019 10:21:04 AM
LogName=Application
SourceName=RoboticLogging
EventCode=0
EventType=4
Type=Information
ComputerName=WTWFBVZP.UNITOPR.UNITINT.TEST.STATEFARM.ORG
TaskCategory=%1
OpCode=Info
RecordNumber=51614
Keywords=Classic
Message=<Robotics Workstation=\"WTWFBVZP\" UserID=\"UNTOPR\OE1OTD\" Department=\"HRSS_NEO\" TaskID=\"Daily NEO Report\" Automation=\"NEO_P_SplunkMetrics\" Message=\"Number of supervisor reminder memos sent: 6,Number of New Employees in NEO Report without job title Temporary Agy Svc Asst: 988,Number of New Employees in NEO Report with job title Temporary Agy Svc Asst: 23,Duration: 00:01:50.5270509\" AdditionalInfo1=\"NA\" AdditionalInfo2=\"NA\""
| kv
| eval _time=mvindex(split(_raw,"
"),0)
| eval _time=strptime(_time,"%m/%d/%Y %T %p")
| fieldformat _time=strftime(_time,"%m/%d/%Y %T %p")
| rex "Message=\"(?<Message>[^\"]+)\""
| table _time LogName SourceName EventCode EventType Type ComputerName TaskCategory OpCode RecordNumber Keywords
,Workstation UserID Department TaskID Automation Message AdditionalInfo1 AdditionalInfo2
| appendpipe
[eval _raw = Message
| eval _raw = replace(_raw,"(\d+:\d+:\d+\.\d+)","\"\1\"")
| extract pairdelim="," kvdelim=":"
| fields - _raw]
| selfjoin Message
Hi, folks.
That's all?
... View more
10-31-2019
12:34 PM
1 Karma
If you would like to get 3 characters, use this:
... | rex "Number of supervisor reminder memos sent:\s*(?<ex>.{3}?)
If you would like to get all characters up to the first character 3 , use this:
... | rex "Number of supervisor reminder memos sent:\s*(?<ex>[^3]+?)
... View more
11-04-2019
12:07 AM
Hi harshparikhxlrd,
Try now:
index=monitoring sourcetype=PEGA:WinEventLog:Application ( SourceName="RoboticLogging" OR SourceName="Application" ) ("Department=" "HRSS_STL") ("Type=" "Error")
| rex "(?ms)ComputerName\=(?<Computername>[^ ]*)Task.*Message\=(?<Message>.*)"
| stats stats values(Message) As Message values(Computername) AS Computername count by ex
| rename ex as Exception
That you can test at https://regex101.com/r/0n0rks/2 .
Ciao.
Giuseppe
... View more
