About ITWhisperer

ITWhisperer

You could change the name of the script so that the browser sees it as a different file.

ITWhisperer

I don't think you can do this at ingest time (but happy to be proved wrong!), but you can parse and split out the elements of the data collection into separate events using spath and mvexpand | spath data{} output=data | mvexpand data | table data

ITWhisperer

Apart from what @gcusello says, rex will only extract contiguous characters into a field, so what you are asking for is not possible in a single rex command.

ITWhisperer

For good reasons, that is the way browsers work!

ITWhisperer

So you want to match any "string" in any event with any other event and count the number of matches? Apart from this being extremely vague, what is it that you are attempting to determine? What are the boundary conditions for determining which strings to try and match? What do you want to do if an event has more than one "string" which matches other strings in other events, do you double count the events?

ITWhisperer

Do something like this to find out which events aren't being counted and adjust your matches accordingly | eval browser=case( searchmatch("*OPR*"),"Opera", searchmatch("*Edg*"),"Edge", searchmatch("*Chrome*Mobile*Safari*"),"Chrome", searchmatch("*firefox*"),"Firefox", searchmatch("*CriOS*safari"),"Safari") | where isnull(browser)

ITWhisperer

You could try something like this | stats count(eval(match(_raw, "Invalid requestTimestamp"))) as IrT count(eval(match(_raw, "error events found for key"))) as eeffk count(eval(match(_raw, "Exception while calling some API ...java.util.concurrent.TimeoutException"))) as toe

ITWhisperer

When rex'ing backslashes, you need to quadruple them | rex "eligible\\\\\":(?<eligibility_status>[^,]+)"

ITWhisperer

Chart will put the columns in ascending order lexicographically. To get around this, you should use transpose, sort and transpose (back). Try something like this | bin span=1d _time aligntime=@d | stats count as myCount by _time, zbpIdentifier | chart values(myCount) over zbpIdentifier by _time limit=0 useother=f | transpose 0 column_name=date header_field=zbpIdentifier | sort 0 -date | eval date=strftime(date, "%Y %m %d") | transpose 0 column_name==zbpIdentifier header_field=date

ITWhisperer

Please share your anonymised raw event in a code block (using the </> button)

ITWhisperer

This looks like JSON - you might be better off using spath to parse the event.

ITWhisperer

Use stats to sum your diffTime values, then use fieldformat with tostring and the "duration" argument to display the value as a string

ITWhisperer

Try something like this | rex mode=sed "s/(?ms).*(?<ei>\<EventID\>\d+\<\/EventID>).*(?<TimeCreated>\<TimeCreated SystemTime='[^']+'\/>).*(?<Computer>\<Computer\>[^\<]+\<\/Computer\>).*(?<TaskName>\<Data Name='TaskName'\>[^\<]+\<\/Data\>).*/\1\2\3\4/g" Caveat: XML sometimes has namespace aliases either embedded or used or both which a proper XML parser would understand but these are not shown in your sample and therefore not catered for in the regex

ITWhisperer

It sounds like you only have two fields? The first one will be used for the x-axis and the second will be a series (of that name) using the (numeric) values for the height of the columns. If this is not what you have, please share your search in full (obfuscated as necessary to obscure sensitive information).

ITWhisperer

Presumably, you are talking about a column chart. The colours only apply to the series, so unless you have different fields with the names you provided, the columns for the series will all be the same colour. If you could provide details of the search you are using in your chart, we might be able to help you.

ITWhisperer

I am not sure why you won't show us what you do have - perhaps we might be able to see what is wrong - what you are sharing with us at the moment is not moving things forward.

ITWhisperer

Your panel will have a search (data source) associated with it - how is that data source configured (with respect to timeframe)?

ITWhisperer

Try something like this earliest = $TimeRange.earliest$, latest=$TimeRange.latest$

ITWhisperer

Please show what is in your token and how you have set it

ITWhisperer

Almost there - try something like this | rex field='alert.message' "On Prem - (?<Name>.*)"

ITWhisperer

Try something like this (in SimpleXML of course!) <row id="banner"> <panel> <html> <style> div[id="banner"].dashboard-row { top: 0; position: sticky; z-index: 9999; } div[id="banner"] div { background-color: yellow; } </style> <h1>Your banner panel</h1> </html> </panel> </row>

ITWhisperer

Try with where | where ApplicationName=$software_input|s$

ITWhisperer

Try using token filters |search ApplicationName=$software_input|s$

ITWhisperer

This is easy to do in Dashboard Studio. Either use absolute or grid layouts.

ITWhisperer

The Total on the y-axis comes from the first column listed in your results, so replace that with a column with a space for a name | rex field=message "IamExample(?<total>).*" | rex field=message ".*ACCOUNT(?<accountreg>.*):" | rex field=message ".*Login(?<login>.*)" | rex field=message ".*Profile(?<profile>)" | rex field=message ".*Card(?<card>)" | rex field=message ".*Online(?<online>) " | stats count(total) as "_Total" count(accountreg) as "Account" count(login) as "Login" count(profile) as "Profile" count(card) as "Card" count(online) as "Online" | foreach * [| eval name="<<FIELD>>: ".round(100*<<FIELD>>/_Total, 2)."%" | eval {name} = <<FIELD>>] | table " " Account:* Login:* Profile:* Card:* Online:*

Posts	10902
Solutions	2233
Karma Given	65
Karma Received	3254
Member Since	‎2020-08-18

Buttercup Games Request Status Select and Drilldow...

Help with mvexpand limits, one issue is the memory...

Re: dashboard

Re: json parsing

Re: regex

Re: dashboard

Re: Capture similar strings in the logs

Re: browser name extraction from user agent

Re: Capture similar strings in the logs

Re: RegEx

Re: Reverse time info in chart

Re: rex help

Re: rex help

Re: Sum values fields

Re: REGEX Requred

Re: Dashboard

Re: Dashboard

Re: How to display a time range token

Re: How to display a time range token

Re: How to display a time range token

Re: How to display a time range token

Re: Need help on regexing a field to only show eve...

Re: How to freeze the tile in the dashboard

Re: Base Search for Splunk Dashboard

Re: Base Search for Splunk Dashboard

Re: How do I use HTML on multiple panels?

Re: Splunk bar chart how can i display percentage ...