×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
Rodrigo_Larios
Explorer
Member since: ‎07-29-2020
‎05-20-2022
Community Statistics
Posts 11
Solutions 1
Karma Given 3
Karma Received 0
Member Since ‎07-29-2020
Activity Feed
View All

Re: Empty values when using rex to get a string

by in Splunk Search
‎05-20-2022 07:33 PM
‎05-20-2022 07:33 PM
After some research i found there is a tricky thing with slashes, it worked for me: index="mint" apiKey=*** | search event_name=*** extraData.ENDPOINT=***  | eval cleanedJson=substr('extraData.REQUEST_BODY',11) | eval slashCleanJson = replace(cleanedJson,"\\\\","") | rex field=slashCleanJson "(?\"operationName\"\:\"\w+\")" | table opName,slashCleanJson,cleanedJson ... View more

Getting empty values when using rex to get a strin...

by in Splunk Search
‎05-20-2022 06:37 PM
‎05-20-2022 06:37 PM
Hi guys,  This is one example of my data: Optional("{\"operationName\":\"createCart\",\"variables\":{\"customerId\":\"34234323\",\"operationalModel\":\"PICK_AND_COLLECT\",\"storeId\":\"596\"}}") Optional("{\"operationName\":\"getOrdersByCustomer\",\"variables\":{\"pagination\":{\"currentPage\":1,\"pageSize\":100}}}") Basically i want to retrieve all values such as: operationName\":\"createCart\" As context, the field extraData.REQUEST_BODY should be a JSON, but due to a error code (can´t release now to prod), this became a malformed JSON, hence a simple string, so i'm trying to get all operationName values This is my splunk query index="mint" apiKey=*** | search event_name=*** extraData.ENDPOINT=*** | rex field='extraData.REQUEST_BODY' "(?<opName>operationName\\\"\:\\\"\w+\\\")" | table opName i have verified the Regex, and i have removed single quotes from 'extraData.REQUEST_BODY', i have tried to change to double quotes, etc. Could you please help me? Thank you   ... View more
Labels

Dropdown list concatenate my values

by in Dashboards & Visualizations
‎09-09-2020 03:26 PM
‎09-09-2020 03:26 PM
Hi, I'm adding a dropdown input to my dashboard, this is my query:   index="prod_super_cc" source="InventorySnapshot" | spath input=data.InventoryData| search "{}.NodeId"="*" | stats values({}.NodeId) as Stores Or this index="prod_super_cc" source="InventorySnapshot" | spath input=data.InventoryData output=Stores path={}.NodeId | table Stores | mvexpand Stores| stats values(Stores) as Stores at the end bot queries are working with same result, e.g.:   Stores 1053 1075 1118 1159 1160 1196 1248 1408 1492 2766 2829 2830 3025 3034 3140 3177 3199 3223   But when filling the dropdown, y got this: How can i get separated values for each Store value?   Thanks!       ... View more

Re: Filtering on my table

by in Splunk Search
‎09-09-2020 09:04 AM
‎09-09-2020 09:04 AM
Hi, finally it's working:   index="prod_super_cc" source="InventorySnapshot" | spath input=data.InventoryData output=root path={} | table root | mvexpand root | spath input=root | table AvailableToSellQty,NodeId,UPC | rename AvailableToSellQty as Stock, NodeId as Store | where Stock=24 Now i can use where command! Thank you ALL! ... View more

Re: Filtering on my table

by in Splunk Search
‎09-09-2020 07:44 AM
‎09-09-2020 07:44 AM
Hi, thanks for your response. Until this query i got 131 events: index="prod_super_cc" source="InventorySnapshot" | spath input=data.InventoryData| search "{}.UPC"="*" This is one event example of 131 events   08/09/2020 08:53:46.213 { [-]    data: { [-]      InventoryData: [{"UPC":"842034200103","AvailableToSellQty":5,"NodeId":3480},{"UPC":"8200000005","AvailableToSellQty":29,"NodeId":3480},{"UPC":"780432017187","AvailableToSellQty":46,"NodeId":3480},{"UPC":"841011300007","AvailableToSellQty":26,"NodeId":3480},{"UPC":"841011300001","AvailableToSellQty":36,"NodeId":3480},{"UPC":"750105364925","AvailableToSellQty":87,"NodeId":3480},{"UPC":"750105364926","AvailableToSellQty":63,"NodeId":3480},{"UPC":"750635181101","AvailableToSellQty":49,"NodeId":3480},{"UPC":"780432075008","AvailableToSellQty":129,"NodeId":3480},{"UPC":"750105364021","AvailableToSellQty":47,"NodeId":3480},{"UPC":"501032775501","AvailableToSellQty":6,"NodeId":3480},{"UPC":"750103501520","AvailableToSellQty":12,"NodeId":3480},{"UPC":"500026702400","AvailableToSellQty":56,"NodeId":3480},{"UPC":"74460700795","AvailableToSellQty":22,"NodeId":3480},{"UPC":"318537000033","AvailableToSellQty":17,"NodeId":3480},{"UPC":"501032700017","AvailableToSellQty":16,"NodeId":3480},{"UPC":"750302357834","AvailableToSellQty":408,"NodeId":3480},{"UPC":"318537000039","AvailableToSellQty":6,"NodeId":3480},{"UPC":"74460700355","AvailableToSellQty":42,"NodeId":3480},{"UPC":"5019691","AvailableToSellQty":7,"NodeId":3480},{"UPC":"842034200201","AvailableToSellQty":30,"NodeId":3480},{"UPC":"750104881020","AvailableToSellQty":44,"NodeId":3480},{"UPC":"841041536072","AvailableToSellQty":106,"NodeId":3480},{"UPC":"500019600377","AvailableToSellQty":35,"NodeId":3480},{"UPC":"500026701420","AvailableToSellQty":161,"NodeId":3480},{"UPC":"800057043540","AvailableToSellQty":22,"NodeId":3480},{"UPC":"750103501055","AvailableToSellQty":117,"NodeId":3480},{"UPC":"780432006301","AvailableToSellQty":104,"NodeId":3480},{"UPC":"764017566005","AvailableToSellQty":18,"NodeId":3480},{"UPC":"750104881001","AvailableToSellQty":28,"NodeId":3480},{"UPC":"750103504501","AvailableToSellQty":26,"NodeId":3480},{"UPC":"750103501301","AvailableToSellQty":25,"NodeId":3480},{"UPC":"841011300752","AvailableToSellQty":5,"NodeId":3480},{"UPC":"74460700805","AvailableToSellQty":19,"NodeId":3480},{"UPC":"779154012710","AvailableToSellQty":85,"NodeId":3480},{"UPC":"74460700807","AvailableToSellQty":24,"NodeId":3480},{"UPC":"8051613514","AvailableToSellQty":197,"NodeId":3480},{"UPC":"740100500451","AvailableToSellQty":15,"NodeId":3480},{"UPC":"74460700806","AvailableToSellQty":13,"NodeId":3480},{"UPC":"780432016969","AvailableToSellQty":30,"NodeId":3480},{"UPC":"74460700803","AvailableToSellQty":15,"NodeId":3480},{"UPC":"731204001701","AvailableToSellQty":58,"NodeId":3480},{"UPC":"779154012716","AvailableToSellQty":145,"NodeId":3480},{"UPC":"750103501348","AvailableToSellQty":36,"NodeId":3480},{"UPC":"841002604740","AvailableToSellQty":61,"NodeId":3480},{"UPC":"541031695052","AvailableToSellQty":25,"NodeId":3480},{"UPC":"750100866020","AvailableToSellQty":80,"NodeId":3480},{"UPC":"750100866021","AvailableToSellQty":99,"NodeId":3480},{"UPC":"750103504316","AvailableToSellQty":77,"NodeId":3480},{"UPC":"841010602325","AvailableToSellQty":34,"NodeId":3480},{"UPC":"843701160176","AvailableToSellQty":2,"NodeId":3480},{"UPC":"841022111015","AvailableToSellQty":18,"NodeId":3480},{"UPC":"500026711720","AvailableToSellQty":24,"NodeId":3480},{"UPC":"843601425251","AvailableToSellQty":24,"NodeId":3480},{"UPC":"74978750013","AvailableToSellQty":46,"NodeId":3480},{"UPC":"5019638","AvailableToSellQty":50,"NodeId":3480},{"UPC":"324599096941","AvailableToSellQty":5,"NodeId":3480},{"UPC":"501101310015","AvailableToSellQty":55,"NodeId":3480},{"UPC":"501010380031","AvailableToSellQty":55,"NodeId":3480},{"UPC":"750100561751","AvailableToSellQty":18,"NodeId":3480},{"UPC":"841011300708","AvailableToSellQty":24,"NodeId":3480},{"UPC":"750103501312","AvailableToSellQty":14,"NodeId":3480},{"UPC":"304961000410","AvailableToSellQty":9,"NodeId":3480},{"UPC":"8218409047","AvailableToSellQty":83,"NodeId":3480},{"UPC":"8043240039","AvailableToSellQty":18,"NodeId":3480},{"UPC":"500029102070","AvailableToSellQty":45,"NodeId":3480},{"UPC":"750103501080","AvailableToSellQty":8,"NodeId":3480},{"UPC":"5019613","AvailableToSellQty":83,"NodeId":3480},{"UPC":"780432042235","AvailableToSellQty":43,"NodeId":3480},{"UPC":"500028105626","AvailableToSellQty":80,"NodeId":3480},{"UPC":"750302357821","AvailableToSellQty":27,"NodeId":3480},{"UPC":"500028105624","AvailableToSellQty":41,"NodeId":3480},{"UPC":"750104881030","AvailableToSellQty":39,"NodeId":3480},{"UPC":"475002100015","AvailableToSellQty":55,"NodeId":3480},{"UPC":"750103501203","AvailableToSellQty":31,"NodeId":3480},{"UPC":"841059100127","AvailableToSellQty":245,"NodeId":3480},{"UPC":"750103501202","AvailableToSellQty":60,"NodeId":3480}]    }    id: 870a974d-be0b-4598-b5cf-d8961ed73ed5    message: Congo Inventory Snapshot    severity: INFO }   When i put complete query index="prod_super_cc" source="InventorySnapshot" | spath input=data.InventoryData| search "{}.UPC"="*" | spath {} output=root |table root |mvexpand root | spath input=root|table UPC,AvailableToSellQty,NodeId | rename AvailableToSellQty as "Stock", NodeId as Store | where Stock=0 I'm not getting results, even removing where clause. I hope above example may help us. Thanks     ... View more

Re: Filtering on my table

by in Splunk Search
‎09-08-2020 01:19 PM
‎09-08-2020 01:19 PM
Hi,  I'm getting same block of results,  The search is working since i'm getting those blocks of data which contain 0 values, but when sending to splunk table, i'm getting all rows (I'm searching within a big json of data) This is one of the multiple blocks i'm getting. What i want is just to recover records with "0" values, from splunk final table. UPC Stock Store     842034200103 8200000005 780432017187 841011300007 841011300001 750105364925 750105364926 750635181101 780432075008 501032775501 750105364021 750103501520 500026702400 74460700795 318537000033 318537000039 501032700017 750302357834 74460700355 5019691 842034200201 750104881020 841041536072 500019600377 500026701420 800057043540 750103501055 780432006301 764017566005 750104881001 750103501301 750103504501 841011300752 74460700805 779154012710 8051613514 740100500451 74460700807 780432016969 74460700806 74460700803 731204001701 779154012716 750103501348 841002604740 541031695052 750100866020 750100866021 841010602325 750103504316 841022111015 500026711720 843701160176 843601425251 74978750013 5019638 324599096941 501101310015 501010380031 750100561751 750103501312 841011300708 304961000410 8218409047 8043240039 500029102070 500028105626 750103501080 5019613 780432042235 750302357821 500028105624 750104881030 475002100015 750103501203 750103501202 841059100127 23 17 34 110 49 16 153 30 183 8 8 0 54 42 11 12 25 98 14 5 37 52 29 39 133 10 82 31 0 92 11 120 4 15 80 185 19 30 102 44 12 66 106 38 8 71 490 161 184 96 55 11 6 0 153 50 12 92 73 16 12 12 6 27 33 51 43 13 113 63 13 14 161 81 224 53 143 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817 5817   ... View more

Filtering on my table

by in Splunk Search
‎09-08-2020 11:01 AM
‎09-08-2020 11:01 AM
Hi I got following values as a result of a splunk table: 842034200103 8200000005 780432017187 841011300007 841011300001 750105364925 750105364926 750635181101 780432075008 750105364021 501032775501 750103501520 500026702400 74460700795 318537000033 501032700017 750302357834 318537000039 74460700355 5019691 842034200201 750104881020 500019600377 841041536072 500026701420 800057043540 750103501055 780432006301 764017566005 750104881001 750103501301 750103504501 841011300752 74460700805 779154012710 74460700807 8051613514 740100500451 780432016969 74460700806 74460700803 731204001701 779154012716 750103501348 841002604740 541031695052 750100866020 750100866021 841010602325 750103504316 843701160176 500026711720 841022111015 843601425251 74978750013 5019638 324599096941 501101310015 501010380031 750100561751 841011300708 750103501312 304961000410 8218409047 8043240039 500029102070 500028105626 5019613 780432042235 750103501080 750302357821 500028105624 750104881030 475002100015 750103501203 841059100127 750103501202 22 22 12 4 23 83 24 12 12 15 4 0 54 47 27 2 9 16 4 4 13 22 10 23 13 7 26 29 6 65 30 25 21 20 12 37 30 16 7 70 17 23 24 13 5 6 31 18 30 53 14 9 5 20 12 71 4 4 10 51 6 15 7 17 24 3 18 7 11 5 118 4 4 4 207 15 59 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814 3814   This is my splunk query index="prod_super_cc" source="InventorySnapshot" | spath input=data.InventoryData| search "{}.UPC"="*" | table {}.UPC,{}.AvailableToSellQty,{}.NodeId | rename "{}.UPC" as "UPC", "{}.AvailableToSellQty" as "Stock", "{}.NodeId" as Store | where Stock=0 I need to filter some specific values from this table, such as "0" for example. 750103501520 - 0 - 3814 I've tried with where sentence but i can´t get the desired result. Thanks for your help ... View more

Limited Results

by in Splunk Search
‎09-06-2020 05:42 PM
‎09-06-2020 05:42 PM
Hi, I got a lot of events with a Gtin value, near 177 events. When i search with next sentence, i'm getting only 3 values, eventhough i got more events. index="prod_super_cc" source="InventorySnapshot" | spath input=data.InventoryData | search "InventoryDetails.InventoryDetail{}.Gtin"="*" All my events have Gtin values, and my data.InventoryData is a JSON string such as: InventoryData: {"InventoryDetails":{"InventoryDetail":[{"Gtin":74460700795,"NodeId":4581,"ItemNbr":100394282,"AvailableToSellQty":0,"InTransitQty":0,"MaxFloorQty":14,"InWarehouseQty":0,"OnOrderQty":0},{"Gtin":74460700355,"NodeId":4581,"ItemNbr":100370309,"AvailableToSellQty":0,"InTransitQty":0,"MaxFloorQty":12,"InWarehouseQty":0,"OnOrderQty":0},{"Gtin":750104881020,"NodeId":4581,"ItemNbr":9615187,"AvailableToSellQty":0,"InTransitQty":0,"MaxFloorQty":18,"InWarehouseQty":0,"OnOrderQty":0},{"Gtin":750103501055,"NodeId":4581,"ItemNbr":9605734,"AvailableToSellQty":0,"InTransitQty":0,"MaxFloorQty":14,"InWarehouseQty":0,"OnOrderQty":0},{"Gtin":750104881001,"NodeId":4581,"ItemNbr":9655475,"AvailableToSellQty":0,"InTransitQty":0,"MaxFloorQty":16,"InWarehouseQty":0,"OnOrderQty":0},{"Gtin":750103501301,"NodeId":4581,"ItemNbr":9611924,"AvailableToSellQty":0,"InTransitQty":0,"MaxFloorQty":14,"InWarehouseQty":0,"OnOrderQty":0},{"Gtin":74460700805,"NodeId":4581,"ItemNbr":100394281,"AvailableToSellQty":0,"InTransitQty":0,"MaxFloorQty":12,"InWarehouseQty":0,"OnOrderQty":0},{"Gtin":750103501227,"NodeId":4581,"ItemNbr":100155557,"AvailableToSellQty":0,"InTransitQty":0,"MaxFloorQty":14,"InWarehouseQty":0,"OnOrderQty":0},{"Gtin":74460700807,"NodeId":4581,"ItemNbr":100394283,"AvailableToSellQty":0,"InTransitQty":0,"MaxFloorQty":12,"InWarehouseQty":0,"OnOrderQty":0},{"Gtin":74460700806,"NodeId":4581,"ItemNbr":100394279,"AvailableToSellQty":0,"InTransitQty":0,"MaxFloorQty":12,"InWarehouseQty":0,"OnOrderQty":0},{"Gtin":74460700803,"NodeId":4581,"ItemNbr":100394280,"AvailableToSellQty":0,"InTransitQty":0,"MaxFloorQty":12,"InWarehouseQty":0,"OnOrderQty":0},{"Gtin":750103501348,"NodeId":4581,"ItemNbr":9666821,"AvailableToSellQty":0,"InTransitQty":0,"MaxFloorQty":7,"InWarehouseQty":0,"OnOrderQty":0},{"Gtin":74978750013,"NodeId":4581,"ItemNbr":100187231,"AvailableToSellQty":4,"InTransitQty":0,"MaxFloorQty":7,"InWarehouseQty":0,"OnOrderQty":0},{"Gtin":750100561751,"NodeId":4581,"ItemNbr":100227362,"AvailableToSellQty":0,"InTransitQty":0,"MaxFloorQty":16,"InWarehouseQty":0,"OnOrderQty":0},{"Gtin":750103501312,"NodeId":4581,"ItemNbr":9654178,"AvailableToSellQty":0,"InTransitQty":0,"MaxFloorQty":16,"InWarehouseQty":0,"OnOrderQty":0},{"Gtin":500028105626,"NodeId":4581,"ItemNbr":100327653,"AvailableToSellQty":12,"InTransitQty":0,"MaxFloorQty":10,"InWarehouseQty":0,"OnOrderQty":0},{"Gtin":500028105624,"NodeId":4581,"ItemNbr":100341374,"AvailableToSellQty":0,"InTransitQty":0,"MaxFloorQty":10,"InWarehouseQty":0,"OnOrderQty":0},{"Gtin":750103501203,"NodeId":4581,"ItemNbr":9602610,"AvailableToSellQty":0,"InTransitQty":0,"MaxFloorQty":14,"InWarehouseQty":0,"OnOrderQty":0},{"Gtin":750103501202,"NodeId":4581,"ItemNbr":9602645,"AvailableToSellQty":0,"InTransitQty":0,"MaxFloorQty":16,"InWarehouseQty":0,"OnOrderQty":0}]}} Why splunk is not getting the rest of events? How can i get all Gtin values? ... View more

Re: Filtering values within JSON searching

by in Splunk Search
‎07-29-2020 04:54 PM
‎07-29-2020 04:54 PM
GREAT!  It works! mvfilter is useful, i didn´t know about it, and single quotes is what i needed. This is my final splunk query. index="prod_super_cc" source=ETL_GRO_01ReadMessagesKafka| spath input=data.Orders | search "{}.LineRusherTransaction"="*" | table {}.LineRusherTransaction | eval LRTrans=mvfilter('{}.LineRusherTransaction'>0) | stats values(LRTrans) Thanks! ... View more

Re: Filtering values within JSON searching

by in Splunk Search
‎07-29-2020 04:26 PM
‎07-29-2020 04:26 PM
HI @bowesmana , thanks for responding! I just tried with this example but it still is not working. I adapted it to my splunk query:  index="prod_super_cc" source=ETL_GRO_01ReadMessagesKafka| spath input=data.Orders | search "{}.LineRusherTransaction"="*" | table {}.LineRusherTransaction | eval LR=mvfilter({}.LineRusherTransaction>0) The message i'm getting is: Error in 'eval' command: The expression is malformed. An unexpected character is reached at '{}.LineRusherTransaction>0)'. I think the problem revolves around the {}.LineRusherTransaction which comes from a JSON property. Here you can see the example: {"OrderId":34399561,"TC":"04012745288666084055","TicketTypeCode":"Return","LineRusherTransaction":0},{"OrderId":34411872,"TC":"086094460458888015219","TicketTypeCode":"Sale","LineRusherTransaction":0},{"OrderId":34396744,"TC":"396044065436486007448","TicketTypeCode":"Sale","LineRusherTransaction":48580196744},{"OrderId":34412000,"TC":"986034168431288388420","TicketTypeCode":"Sale","LineRusherTransaction":0}, So, i'm trying to get all records with LineRusherTransaction and then trying to remove zeros sending all values to a table and then removing with eval.  But i don´t know how to include this reference ({}.LineRusherTransaction) into the eval command. What do you think? ... View more

Filtering values within JSON searching

by in Splunk Search
‎07-29-2020 10:11 AM
‎07-29-2020 10:11 AM
Hi, i'm trying to filter values greater than zero. I have this search: index="prod_super_cc" source=ETL_GRO_01ReadMessagesKafka| spath input=data.Orders | search "{}.LineRusherTransaction"="*" | stats values({}.LineRusherTransaction) as LRTransactions it brings some results including zero values and greater than zero values LRTransactions 0 48580100196 48580100231 48580100687 48580100744 48580100909 48580100910 48580101088 48580101119 48580101320  But i want to remove zero values. I've tried using: | search "{}.LineRusherTransaction">"0" | search "{}.LineRusherTransaction">0 also | where LRTransactions>0 (No results) I've tried with index="prod_super_cc" source=ETL_GRO_01ReadMessagesKafka| spath input=data.Orders | search "{}.LineRusherTransaction"="*" | table {}.LineRusherTransaction | where "{}.LineRusherTransaction" > 0 Message says: Error in 'where' command: Type checking failed. The '>' operator received different types. 😓 Without a expected result. I just want to filter values by removing zero values. Could you please help me please? Thank you 😃 ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎05-20-2022 11:37 PM
Karma given to