Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About broman
broman
Explorer
Member since:
09-23-2011
06-05-2020
Community Statistics
| Posts | 7 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 09-23-2011 |
Activity Feed
- Got Karma for Re: Is it possible to compare field values in transaction?. 06-05-2020 12:48 AM
- Posted Re: Is it possible to compare field values in transaction? on Splunk Search. 11-30-2016 03:22 AM
- Posted Re: Is it possible to compare field values in transaction? on Splunk Search. 11-29-2016 02:08 AM
- Posted Is it possible to compare field values in transaction? on Splunk Search. 11-09-2016 10:38 AM
- Tagged Is it possible to compare field values in transaction? on Splunk Search. 11-09-2016 10:38 AM
- Tagged Is it possible to compare field values in transaction? on Splunk Search. 11-09-2016 10:38 AM
- Tagged Is it possible to compare field values in transaction? on Splunk Search. 11-09-2016 10:38 AM
- Tagged Is it possible to compare field values in transaction? on Splunk Search. 11-09-2016 10:38 AM
- Posted Re: regex (Invalid regex: no named extraction at position 5 ) on Splunk Search. 02-12-2015 07:38 AM
- Posted Re: regex (Invalid regex: no named extraction at position 5 ) on Splunk Search. 02-12-2015 07:28 AM
- Posted Re: regex (Invalid regex: no named extraction at position 5 ) on Splunk Search. 02-12-2015 07:16 AM
- Posted regex (Invalid regex: no named extraction at position 5 ) on Splunk Search. 02-12-2015 06:56 AM
- Tagged regex (Invalid regex: no named extraction at position 5 ) on Splunk Search. 02-12-2015 06:56 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
11-30-2016
03:22 AM
I downvoted this post because i don't try to search transaction with specific thread id but transaction where specified filed inside it has different values
... View more
11-29-2016
02:08 AM
1 Karma
It looks promising but doesn't work 😞 I have firstX in fields list but when I add last line it doesn't return anything. But Inspired by mvindex I found mvcount in documentation and write such query
index=mysource sourcetype=aem_error | rex field=_raw "(\s+[^\s]+){3} \[(?<ThreadId>\S+)\]" | rex field=_raw "(\s+[^\s]+){2} \[(?<filedX>\S+)" | transaction maxpause=4m keepevicted=true ThreadId host | eval xCount=mvcount(filedX) | where xCount!=1
... View more
11-09-2016
10:38 AM
Is there any way to compare fields in transaction to find all transactions where some fields are the same or different in all events in transaction?
My transaction search:
index=ourindex sourcetype=aem_error | rex field=_raw "(\s+[^\s]+){3} \[(?<ThreadId>\S+)\]" | transaction maxpause=4m keepevicted=true ThreadId host
... View more
02-12-2015
07:28 AM
in some log lines I have nested [] so I try to handle this in regex.
... View more
02-12-2015
07:16 AM
done, thanks for notice
... View more
02-12-2015
06:56 AM
I have problem with saving regex for extracting class name
Here is my regex
(?i)\[([0-9a-zA-Z\.\s\-]*(\[[0-9]*\])?[0-9a-zA-Z\.\s\-\/]*)\]\s(?P<FIELDNAME>[^ ]+)
And here is log sample
12.02.2015 12:14:16.946 INFO [10.36.27.187 [1423743256597] GET /content/company/global/en/company/notices/polish.html HTTP/1.1] com.company.web.core.cdn.CDNTransformer CDN: http://static-dc.company.net
12.02.2015 14:17:03.340 INFO [pool-5-thread-3] org.apache.jackrabbit.core.state.SharedItemStateManager Validating change-set hierarchy
And here is splunk error
"Invalid regex: no named extraction at position 5 (i.e., "[([0-9a-zA..."). Expected "(?P<variable>pattern)""
... View more
- Tags:
- regex
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
