Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About nandhiniG
nandhiniG
Explorer
Member since:
07-21-2020
09-08-2021
Community Statistics
| Posts | 10 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 07-21-2020 |
Activity Feed
- Posted Re: Combine the results of a table in one single row on Splunk Search. 09-07-2021 08:09 AM
- Karma Re: Combine the results of a table in one single row for ITWhisperer. 09-07-2021 08:09 AM
- Posted Combine the results of a table in one single row on Splunk Search. 09-07-2021 07:38 AM
- Posted Re: Display Values not found in search results but is in lookup table on Splunk Search. 09-03-2021 02:25 AM
- Posted Re: Display Values not found in search results but is in lookup table on Splunk Search. 09-02-2021 02:20 AM
- Posted Why are Display Values not found in search results but is in lookup table? on Splunk Search. 09-01-2021 08:35 AM
- Posted Re: extract two values as field from following log and show average count of requests. on Splunk Enterprise. 08-31-2020 04:40 AM
- Posted Re: extract two values as field from following log and show average count of requests. on Splunk Enterprise. 08-31-2020 04:14 AM
- Tagged extract two values as field from following log and show average count of requests. on Splunk Enterprise. 08-31-2020 03:12 AM
- Tagged extract two values as field from following log and show average count of requests. on Splunk Enterprise. 08-31-2020 03:12 AM
- Posted extract two values as field from following log and show average count of requests. on Splunk Enterprise. 08-31-2020 02:41 AM
- Tagged extract two values as field from following log and show average count of requests. on Splunk Enterprise. 08-31-2020 02:41 AM
- Posted Re: Regex: I want to extract two fields from a log message and visualize as a line chart on Splunk Search. 07-21-2020 01:13 AM
- Posted Regex: I want to extract two fields from a log message and visualize as a line chart on Splunk Search. 07-21-2020 12:11 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-07-2021
08:09 AM
Thanks a lot it worked!!!
... View more
09-07-2021
07:38 AM
I have a splunk query that results in a table , while creating alert it just sends the first row of the results ,so we are missing the remaining results. Inorder to address this , i wanted to combine the results in one row or a message to be sent. QUERY: | inputlookup gtsnet.csv | fields "dataset_name" | search NOT [search index = asvdataintegration source=piedpiper sts_asvdataintegration_symphony_lambda_clewriter_events | search event.proc_stat_cd = "SCSS" AND event.evt_dtl.EventDesc = "workflow_found" AND event.module_response.requester = "_SUCCESS" AND event.s3_location = "*"s3://cof-data-*/"*"/lake/gtsnet*"*" AND "event.module_name"=LAMBDA | rename event.regrd_dataset_nm as dataset_name | table dataset_name | format] Current Format: Expected Format:
... View more
09-03-2021
02:25 AM
Anyway , i tried to add the input lookup first like below and retrieved the missing dataset names only. and it worked . | inputlookup data.csv | fields "dataset_name" | search NOT [search index = asvdataintegration source=piedpiper sts_asvdataintegration_symphony_lambda_clewriter_events | search event.proc_stat_cd = "SCSS" OR event.proc_stat_cd = "FAIL" AND event.s3_location = "*"s3://cof-*/"*"/lake/depositescrow*"*" AND "event.module_name"=EMR | rename event.regrd_dataset_nm as dataset_name | table dataset_name | format]
... View more
09-02-2021
02:20 AM
It is not working , as expected. It displays the matching search results - which means the files are moved .But not displaying the files missed . ex: i have two datasets --> first.dat ,second.dat lets assume first.dat is the only file processed,and the splunk search results have only one log datasetId dataset_name FilesMoved 1 first.dat YES 2 second.dat NO
... View more
09-01-2021
08:35 AM
I Have a look up file called dataset.csv which will have one field,
dataset_name
dataset1
dataset2
dataset3
I need to display the dataset_names in a table which are not present in the search results but present in lookup , i use the below query to retrieve all the datasets . but using lookup it does not show the missing names.
QUERY :
index = dataIntegration source=piedpiper lambda_events| search event.proc_stat_cd = "SCSS" AND event.s3_location = "*"s3:*//lake/depositescrow*"*" AND "event.module_name"=EMR | rename event.dataset_id as "Id" |rename event.regrd_dataset_nm as Name |rename event.proc_ts as "DateTime"| table "Id" , "Name","DateTime"
I want the results like,how can i achieve this
DatasetName
FilesMoved
Time
dataset1
YES
dataset2
NO
... View more
08-31-2020
04:40 AM
Thank you !!! it works
... View more
08-31-2020
04:14 AM
I used the suggested pattern with sma;ll changes for extracting field as table , "Successfully retrieved the account details for user:"| rex field=msg "feature: \"(?<featurename>[^,]+), scenario: (?<scenarioname>[^\"]+)\"" | table featurename scenarioname but the string value is not extracted in table i see empty tables
... View more
08-31-2020
02:41 AM
i want to extract two values from the below log message like TestUser as one field(featuename) and accounts_fetch as scenario name , and visualize the average requests for featurename +sceanrioname "Successfully retrieved the account details for user: KL**19**19**19**19**11**11**11** with feature: TestUser, scenario: accounts_fetch"
... View more
Labels
- Labels:
-
metrics
07-21-2020
01:13 AM
I want to visualize the time taken for each request with the resulting count of accounts
... View more
07-21-2020
12:11 AM
HI , I have a log message like " total accounts for user is 11 retrieved in 67 milliseconds". How to extract 11 as totalaccounts and 67 as seconds and visualize a chart
... View more
Labels
- Labels:
-
chart
-
field extraction
-
regex
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-08-2021
05:46 AM
|
