Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About VS0909
VS0909
Communicator
Member since:
08-30-2020
10-19-2021
Community Statistics
| Posts | 70 |
| Solutions | 0 |
| Karma Given | 40 |
| Karma Received | 0 |
| Member Since | 08-30-2020 |
Activity Feed
- Karma Re: IP address for the last occurrence for scelikok. 09-07-2021 11:04 PM
- Karma Re: IP address for the last occurrence for gcusello. 09-07-2021 11:04 PM
- Posted Re: IP address for the last occurrence on Splunk Search. 09-07-2021 10:58 PM
- Posted Re: IP address for the last occurrence on Splunk Search. 09-07-2021 06:53 AM
- Posted Re: IP address for the last occurrence on Splunk Search. 09-07-2021 06:06 AM
- Karma Re: IP address for the last occurrence for gcusello. 09-07-2021 05:54 AM
- Posted Re: IP address for the last occurrence on Splunk Search. 09-07-2021 04:54 AM
- Posted Re: IP address for the last occurrence on Splunk Search. 09-07-2021 03:43 AM
- Posted IP address for the last occurrence on Splunk Search. 09-07-2021 03:42 AM
- Posted Re: Regex for last IP Address on Splunk Search. 09-07-2021 03:41 AM
- Posted Regex for last IP Address on Splunk Search. 09-06-2021 09:51 PM
- Karma Re: Logs between "string1" and "string2" for gcusello. 09-06-2021 02:06 AM
- Karma Re: Logs between "string1" and "string2" for gcusello. 09-06-2021 01:06 AM
- Posted Re: Logs between "string1" and "string2" on Splunk Search. 09-06-2021 01:05 AM
- Posted Re: Logs between "string1" and "string2" on Splunk Search. 09-05-2021 11:02 PM
- Posted Logs between "string1" and "string2" on Splunk Search. 09-03-2021 08:27 AM
- Karma Re: % failures for each day during the time range selected for ITWhisperer. 07-27-2021 04:48 AM
- Posted Re: Value from a panel1, and using that value in panel2 in Splunk Dashboard? on Splunk Search. 07-27-2021 04:23 AM
- Posted Value from a panel1, and using that value in panel2 in Splunk Dashboard? on Splunk Search. 07-27-2021 04:12 AM
- Posted Re: % failures for each day during the time range selected on Splunk Search. 07-27-2021 04:09 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-07-2021
10:58 PM
@gcusello Thanks for the reply! rex ".*(?<IP>\d+\.\d+\.\d+\.\d+)" - this is capturing the last IP, but instead of capturing "230.44.333.122" , its capturing "0.44.333.222" Appreciate your help on this.
... View more
09-07-2021
06:53 AM
Thanks for the repply @gcusello . It is still taking the first value. Can you please help! Thanks!
... View more
09-07-2021
06:06 AM
@gcusello Thanks for the reply. | rex "\s(?<IP>\d+\.\d+\.\d+\.\d+)" This regex is capturing all the IPs in the event. I just need the last IP . can you please help with that.
... View more
09-07-2021
04:54 AM
@gcusello Please find below details There may be one or more IP's in the event Sample logs with two IP's: - - - [07/Sep/2020:06:42:58 -0500] "ssa/edit.jsp?assetURI HTTP/1.1" HTTP/1.1 200 1111 1111 0.222/444 Mozilla/1.0 (Windows NT 1.0; Win64; x64)110.10.222.22 LKMKOIL8098mnmdsLO799 230.44.333.122 wwwsss.abc.com Sample logs with one IP: - - - [07/Sep/2020:06:42:58 -0500] "ssa/edit.jsp?assetURI HTTP/1.1" HTTP/1.1 200 1111 1111 0.222/444 Mozilla/1.0 (Windows NT 1.0; Win64; x64) - http://abc:8080/bbb/aaa/mmm?_requestid=39999 230.44.333.222 LKMKOIL8098mnmdsLO799 - abcde1
... View more
09-07-2021
03:43 AM
@gcusello Can you help with the Splunk query for the below scenario: I want to extract last IP address by a regular expression (regex) , for an event which has one or more IP addresses. If the event has one IP ---> then extract that IP If the event has more than one IP ---> then extract the last IP Thanks!
... View more
09-07-2021
03:42 AM
Can someone please help with the Splunk query for the below scenario: I want to extract last IP address by a regular expression (regex) , for an event which has one or more IP addresses. If the event has one IP ---> then extract that IP If the event has more than one IP ---> then extract the last IP Thanks!
... View more
09-07-2021
03:41 AM
Can someone please help with the Splunk query for the below scenario: I want to extract last IP address by a regular expression (regex) , for an event which has one or more IP addresses. If the event has one IP ---> then extract that IP If the event has more than one IP ---> then extract the last IP Thanks!
... View more
09-06-2021
09:51 PM
Can someone please help with the Splunk query for the below scenario: I want to extract last IP address by a regular expression (regex) , for an event which has one or more IP addresses. If the event has one IP ---> then extract that IP If the event has more than one IP ---> then extract the last IP Thanks!
... View more
09-06-2021
01:05 AM
@gcusello Thanks for the reply I also want to print the line in the extracted Error or SEVERE line. Can you pls help with that.
... View more
09-05-2021
11:02 PM
@gcusello @shivanshu1593 Please find the below sample. I want to extract the logs between "Abc fgh, app continuing" and "started in". If there are "ERROR" or "SEVERE" keywords in the extracted logs, then I want to print that "ERROR" or "SEVERE" line. 2021-08-31 02:03:52,081 INFO [stdout] jkwqdwqjdk 2021-08-31 02:03:52,081 INFO [stdout] (ServerService Thread Pool -- 83) 2021-08-31 02:03:52,081 INFO [stdout] (ServerService Thread Pool -- 83) Abc fgh, app continuing 2021-08-31 02:03:52,081 INFO [stdout] (ServerService Thread Pool -- 83) 2021-08-31 02:03:52,081 INFO [stdout] (ServerService Thread Pool -- 83)kwqskqw 2021-08-31 02:03:52,081 INFO [stdout] (ServerService Thread Pool -- 83) 2021-08-31 02:03:52,081 INFO [org.kjskj.akjs] (ServerService Thread Pool -- 11) WFLYUT0021: Registered web context: '/dyn' for server 'default-server' 2021-08-31 02:03:52,081 ERROR [org.kjskj.akjs] "There is an error" 2021-08-31 02:03:52,081 SEVERE [org.kjskj.akjs] There is Severe 2021-08-31 02:03:55,166 INFO [org.jboss.as] (Controller Boot Thread) WAAAAAA0033: JBoss EAP 1.1.9.GA (abcfegc Core 2.0.10.Final-call-00000) started in 169999ms - Started 2222 of 2222 services (311 services are lazy, passive or on-demand) 2021-08-31 02:03:55,169 INFO [org.jboss.as] (aa nnnThread) WAAAAAA0033: Http interface listening on http://111.11.11.11:8080/aaa 2021-08-31 02:03:55,169 INFO [org.nnn.as] (ioio llkl Thread) WAAAAAA0033: console listening on http://111.11.11.11:8080/aaa Appreciate your help.
... View more
09-03-2021
08:27 AM
07-27-2021
04:23 AM
@kamlesh_vaghela Thanks for the reply. What if the query returns a table with _time and CountPerDay as columns, with multiple rows?
... View more
07-27-2021
04:12 AM
Is it possible to apply for a formula in dashboard? For eg: Taking a value from a panel1, and using that value in panel2?
... View more
07-27-2021
04:09 AM
@ITWhisperer searchTermForA1 = "A1_API_Failed" searchTermForA2="TESTSTRING" "https://aaa.com/v1/?bbb"
... View more
07-27-2021
03:34 AM
Need help with a Splunk query to display % failures for each day during the time range selected, for same index but different search term % failures = A1/A2 *100 A1= Total number of events returned by the below query: index="abc" "searchTermForA1" A2= Total number of events returned by the below query: index="abc" "searchTermForA2" Expected Output: -------Date-------|--------A1-------------|------A2----------|-----% failures------- Separate rows in the result set for date 1-Jul, 2-Jul, 3-Jul, 4-Jul, 5-Jul, 6-Jul and 7-Jul, for time range selected as 1Jul to 7-Jul. Please help with the query. Thanks!
... View more
07-27-2021
03:31 AM
@ITWhisperer Thanks for the reply! I also have a scenario where I need to find % failure for each day during the time range selected, for same index but different search term % failures = A1/A2 *100 A1= Total number of events returned by the below query: index="abc" "searchTermForA1" A2= Total number of events returned by the below query: index="abc" "searchTermForA2" Please help.
... View more
07-26-2021
02:32 AM
How to add group widgets/panel in a dashboard with a common border? Eg group1 : panel1, panel 2 - combined border for blue color group2 : panel3, panel 4 and panel5 - combined border for red color
... View more
07-22-2021
04:07 AM
@ITWhisperer Thanks for the reply! Can you please help with the complete query here, considering day1 and day7 and also days in between, as same problem may happen for other days as well. Appreciate your help
... View more
07-22-2021
03:06 AM
@ITWhisperer Thanks for the reply! Can you please help with the complete query here, considering day1 and day7 and also days in between, as same problem may happen for other days as well. Appreciate your help
... View more
07-22-2021
01:21 AM
If I run the below query for last 7 days, and if there is no data in logs matching condition index=abc "searchTerm" for day1, then the results are showing for day2 to day7. But I want a row in resultset for day1 as well, if no data then with TotalResults as 0 for day1. index=abc "searchTerm" | bucket _time span=1d | stats count as TotalResults by _time | makecontinuous _time | fillnull TotalResults Please help
... View more
07-21-2021
02:07 AM
Need help with a Splunk query to display % failures for each day during the time range selected % failures = A1/A2 *100 A1= Total number of events returned by the below query: index="abc" "searchTermForA1" A2= Total number of events returned by the below query: index="xyz" "searchTermForA2" Expected Output: -------Date-------|--------A1-------------|------A2----------|-----% failures------- Separate rows in the result set for date 1-Jul, 2-Jul, 3-Jul, 4-Jul, 5-Jul, 6-Jul and 7-Jul, for time range selected as 1Jul to 7-Jul. Please help with the query. Thanks!
... View more
07-19-2021
11:43 PM
@gcusello Thanks for the reply! If I query index="abc" for app1 and app2, will I receive same events?
... View more
07-19-2021
10:12 PM
Can I specify app name in Splunk query and run that query from any app ?
... View more
Labels
07-19-2021
09:59 AM
Can someone please help on the below query? I am using index="abc" . When I run this in app1 and app2, I get different data. I am selecting app from Splunk UI. Can I specify app name in Splunk query?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-19-2021
03:00 AM
|
Karma given to
