Hi team,    We are logging the File copy logs, Application logs into Splunk and using Splunk alerting for file not copied scenarios and connectivity issues.  Along with this alerting we want to take actions based on the connectivity issues/ file not copied scenarios.  So can anyone please share me any scenarios along with examples.    In brief do you have any feature to take action based on the logs from the Splunk.  Also please let me know features of Splunk other than alerting to add the business value.    Thanks in advance,    ... View more

Hi team,    Please help with the regex to fetch the values from below payload -  serverName, HostNumber.  "{\n \"process\": \"Monitoring\",\n \"serverName\": \"\",\n \"HostNumber\": \"\",\n \"startDate\": \"\",\n \"firstName\": \"person _anusha1234\",\n \"lastName\": \"dev1234\",\n \"emailAddress\": \3423423213213@ada.com\,\n \"personnelNumber\": \"812060\",\n \"status\": \"FAILED\",\n \"code\": \"APP:Login_ERR001\",\n \"message\": \"\\\"218177-123132 does not exist in LDAP\\\"\",\n \"errorRecord\": \"BirthName:|BirthPlace:|ActiveFlag:|Role:PINV|Environment:|PrimaryInRole:|HostNumber:|Reference:123132|AlternateNumber:3223|serverName:abc|SubjectStatus:|CreatedBy:|Department:|DiscontinuedDate:|DiscontinuedFlag:N|EmployeeID:|EmployeeStatus:|EmploymentReason:|EmploymentType:|EndDate:|StartDate:|FirstName:person _anusha1234|LastName:dev1234|NPINumber:812060|AddressLine1:|AddressLine2:|AddressLine3:|City:|CountryISO3Code:|Province:|Zip:|EmailAddress:3423423213213@ada.com|Fax:|PhoneNumber:|PersonnelNumber:812060\"\n}\",\n \"tracePoint\" : \"FLOW\",\n \"priority\" : \"INFO\",\n \"category\" : \"com.wipro.api\",\n \"elapsed\" : 1893,\n \"timestamp\" : \"2021-11-09T11:19:53.943Z\",\n \"applicationName\" : \"Monitoring\",\n \"applicationVersion\" : \"v1\",\n \"environment\" : \"Stage\",\n \"threadName\" : \"[MuleRuntime].uber.70: [wipro-prc-primary-monitoring].log-data-for-splunk-dashboard/processors/1.ps.BLOCKING @a8ff6c0\"\n}   Thanks in Advance RK ... View more

Can anyone please help me to create the regex expression for the below log.  > {\\n \\\"process\\\": \\\"get_input\\\",\\n \\\"totalProcessed\\\": \\\"0\\\",\\n \\\"SuccessfullyProcessed\\\": \\\"0\\\",\\n \\\"FailedToProcess\\\": \\\"0\\\",\\n \\\"FileName\\\": \\\"\\\"\\n} I created the regex for this as below, but for the 'FileName' I am getting '\n'.   > | rex field=_raw "process\W+(?<process>[\w\s]+)" | rex field=_raw "totalProcessed\W+(?<totalProcessed>[\w\s]+)"| rex field=_raw "SuccessfullyProcessed\W+(?<SuccessfullyProcessed>[\w\s]+)" | rex field=_raw "FileName\W+(?<FileName>[\w\s]+)" | rex field=_raw "FailedToProcess\W+(?<FailedToProcess>[\w\s]+)" It seems some modification/rebuild the regex is needed.  Please help me on this.    Thanks in advance. ... View more

Hi team,   I have one requirement to prepare a query to get a value from json and do chart count around it. For this I have added multiple chart count queries using appendcols, but it is very slow.  Also I need the timestamp.  log is like as below:  Success: 1 failed: 2 Total: 3 index=<<>> |search app="app1" |rex "Total: (?<TCount>[^\"]*)" |eval TCount=rtrim(TCount,"\\") |chart count(TCount) over TCount |appendcols [search |rex "Success: (?<S_Count>[^\"]*)"|eval S_Count=rtrim(S_Count,"\\") |chart count(S_Count) over S_Count] |appendcols [search |rex "failed: (?<FCount>[^\"]*)"|eval F_Count=rtrim(FCount,"\\") |chart count(FCount) over FCount] Can anyone help me on this to make it run faster.    Thanks in Advance.   ... View more

Hi team,    I am creating a query to fetch a unique id from different events which are having different statuses.  If two log events are having same unique id and with status="START" & status="END" then that application has completed 1 success iteration or else it should be error.  I created one query can't understand how to compare the 'correlationId' from different events.  Can anyone please help with the query to compare the 'correlationId' from different events along with below query. >>  index="dev" | rex "\"Status\\\\\"\s:\s\\\\\"(?<Status>[^\\\]+)" | stats count by applicationName,Status|where Status in("START","END") Below are the logs for 'Start' & 'End' events.   log: [2021-09-01 04:14:10.216] INFO api [[PythonRuntime].uber.12772: [tyt-autoencoding-dev].get-terms-from-oc/processors/1.ps.BLOCKING @f089563] [event: 80961137-6734-4f7f-8750-3d27cdf2a4eb]: { "correlationId" : "80961137-6734-4f7f-8750-3d27cdf2a4eb", "Status" : "START", "priority" : "INFO", "category" : "com.tayota.api", "elapsed" : 0, "timestamp" : "2021-09-01T04:14:10.215Z", "applicationName" : "Toyato Encoding API", "applicationVersion" : "v1", "environment" : "Development", } log: [2021-09-01 04:14:10.216] INFO api [[PythonRuntime].uber.12772: [tyt-autoencoding-dev].get-terms-from-oc/processors/1.ps.BLOCKING @f089563] [event: 80961137-6734-4f7f-8750-3d27cdf2a4eb]: { "correlationId" : "80961137-6734-4f7f-8750-3d27cdf2a4eb", "Status" : "END", "priority" : "INFO", "category" : "com.tayota.api", "elapsed" : 0, "timestamp" : "2021-09-01T04:14:10.215Z", "applicationName" : "Toyato Encoding API", "applicationVersion" : "v1", "environment" : "Development", } Thanks in advance. ... View more