Hey Guys, I am working on a requirement where I have to extract the value of some nodes in XML which are in a name value pair. Those values are nothing but the products purchased from our website but the XML also contains other elements like discount code, additional products etc and I don't have a way to differentiate between those. I have attached a block of code from my XML which I am really interested in. Is there a way to extract those values and then display the top products purchased/used from different events. I am interested in the 2 fields  productIdentifier and name     <ns3:orderItem> <ns3:product> <ns3:productIdentifier>XXXXXXXXXXXXXXX</ns3:productIdentifier> <ns3:name>XXXXX</ns3:name> <ns3:action>New</ns3:action> <ns3:quantity>1</ns3:quantity> <ns3:product> <ns3:productIdentifier>P11845546565263</ns3:productIdentifier> <ns3:name>Mixit TV (M 2)</ns3:name> <ns3:instanceIdentifier>A</ns3:instanceIdentifier> <ns3:action>New</ns3:action> <ns3:quantity>1</ns3:quantity> <ns3:product> <ns3:productIdentifier>P1187877564259</ns3:productIdentifier> <ns3:name>360 Box</ns3:name> <ns3:instanceIdentifier>A</ns3:instanceIdentifier> <ns3:action>New</ns3:action> <ns3:quantity>1</ns3:quantity> </ns3:product> <ns3:product> <ns3:productIdentifier>P118565565656</ns3:productIdentifier> <ns3:name>360 Activation omph</ns3:name> <ns3:instanceIdentifier>A</ns3:instanceIdentifier> <ns3:action>New</ns3:action> <ns3:quantity>1</ns3:quantity> </ns3:product> </ns3:product> <ns3:product> <ns3:productIdentifier>P1068434343545681</ns3:productIdentifier> <ns3:name>Fibre Broadband</ns3:name> <ns3:instanceIdentifier>H</ns3:instanceIdentifier> <ns3:action>New</ns3:action> <ns3:quantity>1</ns3:quantity> <ns3:product> <ns3:productIdentifier>P1046134534341</ns3:productIdentifier> <ns3:name>Manned Install Only code</ns3:name> <ns3:instanceIdentifier>H</ns3:instanceIdentifier> <ns3:action>New</ns3:action> <ns3:quantity>1</ns3:quantity> </ns3:product> <ns3:product> <ns3:productIdentifier>P1015455566454</ns3:productIdentifier> <ns3:name>Manned Install Charge</ns3:name> <ns3:instanceIdentifier>H</ns3:instanceIdentifier> <ns3:action>New</ns3:action> <ns3:quantity>1</ns3:quantity> </ns3:product> </ns3:product> <ns3:product> <ns3:productIdentifier>P1243436565434</ns3:productIdentifier> <ns3:name>Weekend chatter</ns3:name> <ns3:instanceIdentifier>I</ns3:instanceIdentifier> <ns3:action>New</ns3:action> <ns3:quantity>1</ns3:quantity> <ns3:directoryServicesRequest> <ns3:includePhoneNumber>false</ns3:includePhoneNumber> </ns3:directoryServicesRequest> <ns3:product> <ns3:productIdentifier>A1000546567565</ns3:productIdentifier> <ns3:name>Voicemail Free</ns3:name> <ns3:instanceIdentifier>I</ns3:instanceIdentifier> <ns3:action>New</ns3:action> <ns3:quantity>1</ns3:quantity> </ns3:product> <ns3:product> <ns3:productIdentifier>P10454565656545</ns3:productIdentifier> <ns3:name>VOC Line Rental</ns3:name> <ns3:instanceIdentifier>I</ns3:instanceIdentifier> <ns3:action>New</ns3:action> <ns3:quantity>1</ns3:quantity> </ns3:product> </ns3:product> <ns3:product> <ns3:productIdentifier>D1057845454545</ns3:productIdentifier> <ns3:name>Free Install - Non QS address</ns3:name> <ns3:action>New</ns3:action> <ns3:quantity>1</ns3:quantity> </ns3:product> <ns3:product> <ns3:productIdentifier>P105704545458</ns3:productIdentifier> <ns3:name>Install Activation Fee</ns3:name> <ns3:action>New</ns3:action> <ns3:quantity>1</ns3:quantity> </ns3:product> </ns3:product> </ns3:orderItem>       Let me know if anyone has worked on this type of requirement before and if they can be of any help. Best Regards, SA ... View more

Hi, I have a scenario where I receive multiple requests which contain same field value basically OrderNumber. So the backend is receiving duplicate orders from the front end. It only happens every now and then and I'd like to plot a graph which can show me when exactly it happens. I think just the count of duplicates vs _time would be enough. I've tried using a query but it's giving me a distorted graph. Is there a better way to achieve this? Query I have -  index=myapp OrderService "HttpMethod=POST" | rex field=_raw "orderNumber\"\:\s\"(?<orderNumber>[^\"]+)" | bin span=15m _time | stats count by _time orderNumber | where count > 1 | table _time count Let me know if anyone has any suggestions to do this in a better way. ... View more

Hi, I want to create an alert on traffic drop deviation. Something like if the traffic drop by 50% than what was it in last hour or if the traffic drops to zero, then I want the alert triggered. Creating alert on 0 traffic is easy but that could give false positives as well so I am trying to find a way to alert only if there is a significant deviation. Is that possible? I have this query at the moment which looks into the incoming requests. I can run the alert every 15 or 30 minutes and want to trigger if there is a deviation.   index=myapp_prod "message.logPoint"=INCOMING_REQUEST | timechart span=30m count   Best Regards, Shashank ... View more

Hi, I need to create some monitoring and alerts based on high response time of my landing page. The thing is there are always some blips so I want to rule that out and only trigger notifications when there is a consistently high response time for a period of time say 20 mins or 30 mins. How can a write a query like that? I have written a very generic query which gives me the average and 90th percentile response time of every 5 mins like below but I want to trigger the alert only when there is consistently high response times. Let me know if anyone has any suggestions.   index=myapp_prod sourcetype=ssl_access_combined requested_content="/myapp/products*" | eval responseTime= responseTime/1000000 | timechart span=5m avg(responseTime) as AverageResponseTime p90(responseTime) as 90thPercentile   As an example - let's say I want to run the alert every 30 mins and check the condition if there are consistently high response times in last 30 mins or 1 hour, then trigger the alert to send out notifications. Any help is appreciated. Best Regards, Sha ... View more

Hi, I have few alerts created which looks into failure rates of my services and I have put in a condition which says if the failure rate is > 10% AND number of failed request > 200 then trigger the alert. This is really not the ideal way to do the monitoring. Is there a way in Splunk we can use the AI to detect anomalies or outliers over time? So basically if Splunk can detect a failure pattern and if that pattern is consistent then don't trigger an alert but if it goes beyond the threshold, only then trigger it? Can we do this kind of stuff in Splunk using in-built  ML or AI? ... View more

Hi, I have a requirement where I want to create an alert on some of my APIs which are being monitored in Splunk. I've created a search which checks the success/failures of each API and then calculates the failure rate and if that is more than 10% then it triggers the alert. Now what is happening is the alerts gets triggered even for bigger blips when they are only for short duration. Like there is a high increase in error rate for 5 mins and then it gets recovered itself. I don't want to trigger the alert in that situation because it will make unnecessary callouts to people for investigation which is not required. How can i create alert which runs every 30 mins and looks into the failure rate consistently for each 5 mins in the last 30 minutes period. So if the failure rate is consistent for more than 15/20 mins then only trigger the alert. This is my base search     index=api_prod (message.httpResponseCode=50* OR message.httpResponseCode=20*) | rename message.serviceName as serviceName message.httpResponseCode as httpResponseCode | stats count as totalrequests count(eval(like(httpResponseCode, "20%"))) as successrequest count(eval(like(httpResponseCode, "50%"))) as failedrequest by serviceName | eval Total = successrequest + failedrequest | eval failureRatePercentage = round(((failedrequest/totalrequests) * 100),2) | where failureRatePercentage > 10 | fields - Total |table serviceName,totalrequests,successrequest,failedrequest,failureRatePercentage     Any guidance is really appreciated. Best Regards, Shashank ... View more

Hi, Is there a easy and straight forward way of extracting browser versions from access logs using Useragent string. I've a requirement where I have to list out top browsers and top versions of the browser. I was able to manage to extract the browser using the below eval expression  but getting the browser versions are tricky.       | eval browser = case(match(useragent,"Firefox"),"FireFox", match(useragent,"Chrome") AND NOT match(useragent,"Edge"),"Chrome", match(useragent,"Safari") AND NOT match(useragent,"Chrome"),"Safari", match(useragent, "MSIE|Trident|Edge"), "IE", NOT match(useragent, "Chrome|Firefox|Safari|MSIE|Trident|Edge"), "OTHERS")       Has someone done that before and help me steer into right direction. I can't install any app so it has to be done via some regex. Please let me know if someone can help. Very much appreciated in advance Some examples of Useragent Strings - Mozilla/5.0 (Linux; Android 9; ANE-LX1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.87 Mobile Safari/537.36 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.3 Safari/605.1.15 Mozilla/5.0 (Linux; Android 9; ANE-LX1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.87 Mobile Safari/537.36 Mozilla/5.0 (iPhone; CPU iPhone OS 15_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/198.0.425262635 Mobile/15E148 Safari/604.1 Best Regards, Shashank ... View more

Hi, I've been reading number of posts about how to extract the OS and browser details but I don't think there is a better or clean way to do this. I've a similar requirement where in my logs there is a user agent field. Now what I want is to know the browser details along with device like if it's a desktop, mobile etc. Just posting this to see if anyone has figured out anything on this which can save time writing complex SPLs? Any help will be appreciated.  ... View more

Hi, I am sure this question must have asked multiple times and infact I've come across multiple posts but I am still unanswered. So I am a Splunk developer/analyst who is looking to integrate my Splunk Enterprise with OpsGenie to send alert notifications but when I look at the integration here https://support.atlassian.com/opsgenie/docs/integrate-opsgenie-with-splunk/ it says to install an app in Splunk base and when I go to that app https://splunkbase.splunk.com/app/3759/ it says "This app is NOT supported by Splunk. Please read about what that means for you here." What does this mean? As an Admin we can see the app when we browse in Splunk. Does it mean if we install it it won't break or could break other things? Let me know if anyone has done this integration on their on-prem Splunk enterprise architecture. Any input is appreciated. ... View more

Hi, I have uploaded a JSON data from one of my APM tools into Splunk to get some meaningful insights. The events are there for every hour. Every event has 2 fields timeFrameStart & timeFrameEnd which are coming as Epoch time and I have converted them into human readable format. There is another fields called Visits which tells me how many visits were there in that hour. My requirement is to plot a hourly usage graph with time as x-axis (probably derive from timeFrameStart field) and visits on the y-axis. I've written a base query -   source="mydataarchive" host="splunkdev" index="test_index" | eval startTime=strftime(timeFrameStart/1000,"%a,%d %b %Y %H:%M:%S") | eval endTime=strftime(timeFrameEnd/1000,"%a,%d %b %Y %H:%M:%S") | table startTime endTime visits   Let me know if anyone can advice on this using stats or timechart command. ... View more

Hi, I am working on a requirement where I have write an alert based on the failure rate percentage of a service. Let's say I have 10 web services and I want to trigger the alert based on the traffic, successful and failed requests.    I have written a query but it doesn't seem to giving me the correct results -   index=myapp_prod sourcetype=myapp_service_log "System Exception" NOT "responseStatus=SUCCESS" NOT "ResponseStatusCode=404" NOT "Business Exception" | stats count as Failures by serviceName | appendcols [ search index=myapp_prod sourcetype=myapp_service_log "responseStatus=SUCCESS" | stats count as Success by serviceName | fillnull] | eval Total = Success + Failures <!-- when failureRatePercentage > 10 -->   What i want is table like this. With my query, it's not coming right. I am getting multiple rows with same serviceName and empty column serviceName TotalRequest Success Failed FailureRatePercentage service1 1000 800 200 20 service2 2000 1500 500 25   Can anyone advice how can i achieve this? It's better to set the alert based on failure percentage rather than the absolute value ... View more

Hi, I have a weird requirement where I want to find out - If a user as signed into app1, then count them in results. Below is the query which shows signed into app1-   index=test | search apiKey=XXXXX | search (event_name=cable.signin.success AND app_version="1.0.1")   BUT if the same user has signed into app1 and then signed into app2 exclude them from results. Below is the query which shows user signed into app2   index=test | search apiKey=XXXXX | search (event_name=cable.signin.success AND app_version="1.0.2")   Once that is done I want to dedup the customers (field - uid) and then show the result. Do i need to make use of sub search or is there a better way to do this? Let me know if someone can help ... View more