Hello Folks, I have the below query on one of my dashboard panel. Here I pass the IN_BUSINESSDATE field value from dashboard (form input) with default as % and prefix & sufix value as %. So incase user does not provide, the query gets IN_BUSINESSDATE as %%% (its ok) index=dockerlogs  | search app_name = ABCD AND logEvent="Delivered" | spath input=businessKey path=businessDate output=businessDate | spath input=businessKey output=sourceSystem path=sourceSystem | eval businessDate=substr(businessDate,1,10) | where like(businessDate, "$IN_BUSINESSDATE$") | stats count by businessDate, sourceSystem Now I would like to change the stats on the query as below if IN_BUSINESSDATE is not provided (meaning value is %%%) | stats count by sourceSystem How can I achieve this ? Thank you! ... View more

Hello Splunk Experts: From a system, we receive following events in splunk. I would like to get the event which doesn't have logEvent as Received but has only logEvent as Delivered. traceId field will have same value on both Received and Delivered events. Here in the below example, traceId=101 is such an event.     {"logEvent":"Received","traceId": "100","message":"Inbound received", "id" : "00991"} {"logEvent":"Delivered","traceId": "100","message":"Inbound sent", "id" : "00991-0"} {"logEvent":"Delivered","traceId": "101","message":"Inbound sent", "id" : "00992-0"} {"logEvent":"Received","traceId": "102","message":"Inbound received","id" : "00993"} {"logEvent":"Delivered","traceId": "102","message":"Inbound sent","id" : "00993-0"}     ... View more

I am looking for help on stats with eval  Input Events (each json is a event):   { "app_name": "app1","logEvent": "Received"} { "app_name": "app1","logEvent": "Received"} { "app_name": "app1","logEvent": "Missing"} { "app_name": "app1","logEvent": "Delivered"} { "app_name": "app2","logEvent": "Received"} { "app_name": "app2","logEvent": "Delivered"}     My current query is :   index=np-dockerlogs sourcetype=sales | rename log_processed.* as * | eval logEvent =upper(logEvent) | search logEvent IN ("RECEIVED", "DELIVERED", "MISSING") | stats count by logEvent app_name   Current Output: app1 RECEIVED 2 app1 MISSING 1 app1 DELIVERED 1 app2 RECEIVED 1 app2 DELIVERED  1   Output i want to generate is to remove MISSING and subtract the count of Missing from Received. Received = Total Count of Received - Total Count of Missing Delivered = Total Count of Delivered app1 RECEIVED 1 app1 DELIVERED 1 app2 RECEIVED 1 app2 DELIVERED  1   Thank you ... View more

Below are the events:   { "kubernetes" : { "pod_name" : "p1" }, traceId: "t-1" } { "kubernetes" : { "pod_name" : "p1" }, traceId: "t-2" } { "kubernetes" : { "pod_name" : "p2" }, traceId: "t-4" } { "kubernetes" : { "pod_name" : "p3" }, traceId: "t-5" }   I am looking for a dashboard with 2 panels. 1. Showing the unique # of pods 2. Table with Pod Name, # of Number of unique traces For the above event, panels will be 1. Showing the unique # of pods = 3 2. Table with Pod Name, # of Number of unique traces   ---------------------------------- | POD NAME | # of Traces | ---------------------------------- | p1 | 2 | ---------------------------------- | p2 | 1 | ---------------------------------- | p3 | 1 | ----------------------------------     ... View more

I have a json in a field which i like to show on the dashboard as pretty formatted rather single line string. Is there an option in Splunk dashboard to do this? Currently i have the below   {"A":"NAME", "B":"AGE"}   In dashboard one of the column value will be this json which i like to render as    { "A": "NAME", "B": "AGE" }     ... View more

I have 4 applications. All of them generate events like RECEIVED, DELIVERED and DISCARDED.  In my dashboard, i want to have panel which shows : sum of event count of RECEIVED from cs-app1 , cs-app2 and  cs-app3. sum of event count of DELIVERED from cs-app4 and sum of all DISCARDED from all of the app. Currently these 3 are displayed as 3 different timecharts panels.  I would like to combine them as one single timechart which would reduce the clutter on the dashboard.. Is that possible.? If so how should i frame the query which is efficient. Event example { "log_processed" : { "message" : { "app_name" : "cs-app1", "logEvent" : "RECEIVED" } } } RECEIVED events index=dockerlogs | search log_processed.app_name IN ("cs-app1", "cs-app2","cs-app3") | spath input=log_processed.message output=logEvent path=logEvent | search logEvent = "RECEIVED" | timechart span=1d count(logEvent) by logEvent DELIVERED events index=dockerlogs kubernetes.namespace_name=default | search log_processed.app_name IN ("cs-app4") | spath input=log_processed.message output=logEvent path=logEvent | search logEvent = "DELIVERED" | timechart span=1d count(logEvent) by logEvent DISCARDED events index=dockerlogs kubernetes.namespace_name=default | search log_processed.app_name=* | spath input=log_processed.message output=logEvent path=logEvent | search logEvent = "DISCARDED" | timechart span=1d count(logEvent) by logEvent ... View more

Hello Folks, In my current use case i receive events with 3 fields as json .   { 'tid''123', ' 'type': 'R', 'app_name': 'app-1'} Here app_name (app-1 to app-6) are micro services in which tid is generated by app-1 and passed on to other apps. Each app generate 2 events - with type as R and D. So for a transaction there will be 12 events with unique tid.  I want generate a dashboard just out of time range the customer selects so that they get a tabular panel with below columns with the time the event was received. tid | app-1 R | app-1 D | time took| •••• for each app-* If I understand, I need to have 2 searches. (1) get unique tid in app-1 and (2) using the unique tid , search app events and form the above table  Can you pls help me to frame this query as I am stuck with append query. ... View more

Hello Friends, I am looking for your help for a rex expression. message =  [2021-05-26 00:00:33,477] {taskinstance.py:669} INFO - Dependencies all met for <TaskInstance: example_dag_oidc.test_bash 2021-05-25 00:00:00+00:00 [None]>  I would like to split this message field as below fields: logDateTime = 2021-05-26 00:00:33,477 logLevel = INFO logMessage = Dependencies all met for <TaskInstance: example_dag_oidc.test_bash 2021-05-25 00:00:00+00:00 [None]>  Thanks ... View more

Hey Team I have events which contains a field "job_code".  index=default source=jobfeed  I have a lookup (jobs.csv) which has the list of allowed job codes.  jobCode jobDesc 000 EX 001 PT   My requirement is to generate an alert every day, If any of the jobCode available in lookup didn't show up at all on the events for past 2 days. For instance,  for past 2 days if splunk didn't receive event with job_code as 000 , then i need an alert. I need this check for all the jobCode in the lookup table. Can you please help me with a query for this? Thank you ... View more

My events are as below:  Mon Nov 23 09:21:57 2020 6 10.0.0.3 3783 /root/A/P2/source1/POL.IDM b s i r kumar ssh 0 * Mon Nov 23 09:21:58 2020 5 10.0.0.4 3783 /root/A/P2/.stfs/objects/8a/32bcb75c884c00175c989636000ba/b14fbda4-6857-4910-9a74-9789b6165b7f/52925c56-3ae2-4f75-bb3a-97622e9223b0/8a332bcb75c884c00175c989751500c3/POL.IDM b n o r kumar ssh 0 * Mon Nov 23 09:15:25 2020 7 10.0.0.2 68 /root/A/P1/.stfs/objects/8a/325cc74705abd017472f907ce0155/12763075-66b1-4a1b-b080-0c5d0a5a0c11/d8c5486a-57ab-4798-a8cc-2bf45f3b975b/8a3325cc74705abd017472f9bbc701c7/WEB.dat a s o p ftp 0 * If i extract the fields i need the below.: event1 field values in RED, event 2 field values in PINK, event 3 field values in BLUE current_time=Mon Nov 23 09:21:57 2020, Mon Nov 23 09:21:58 2020, Mon Nov 23 09:15:25 2020 transfer_time=6, 5, 7 remote_host=10.0.0.3, 10.0.0.4, 10.0.0.2 file_size=3783, 3783, 68 file_path= /root/A/P2/source1/POL.IDM, /root/A/P2/.stfs/objects/8a/32bcb75c884c00175c989636000ba/b14fbda4-6857-4910-9a74-9789b6165b7f/52925c56-3ae2-4f75-bb3a-97622e9223b0/8a332bcb75c884c00175c989751500c3/POL.IDM, /root/A/P1/.stfs/objects/8a/325cc74705abd017472f907ce0155/12763075-66b1-4a1b-b080-0c5d0a5a0c11/d8c5486a-57ab-4798-a8cc-2bf45f3b975b/8a3325cc74705abd017472f9bbc701c7/WEB.dat ->        Few extracts on this field file_path with / as delimiter: --> This i don't know how to handle                 3rd index extracted as account=P2, P2, P3                  last index extracted as file_name= POL.IDM, POL.IDM, WEB.dat                  last but one index (if start with starts with 8a) extracted as route_id = <null, empty>, <null, empty>, 8a3325cc74705abd017472f9bbc701c7 transfer_mode=b, b, a transfer_security=s, n, s transfer_status=i, o, o access_mode=r, r, p user_name=kumar, kumar, <null,empty> --> This i don't know how to handle protocol=ssh, ssh, ftp Can you please help on Field extractions /Search query for this? Thank you ... View more

Hi Team: Here on the Extraction for Event 2, the MESSAGE field is extracted as empty as its not multiline. How should i extract MESSAGE for both multiline and single line.? Query: index=abcd sourcetype=fallback | rex field=_raw "^(?P<DATETIME>[^,]+),\d+\s+\[(?P<DAEMON>[^\]]+)\]\s+(?P<SEV>[^ ]+)\s+(?P<CLASS>[^ ]+)\s+\-\s+(?P<MESSAGE>(.*[\r\n]+)*)" | table DATETIME, DAEMON, SEV, CLASS, MESSAGE Event 1: 2020-12-07 17:43:02,075 [ABCD_Daemon1] WARN ABCD_CLASS1 - Failed to process java.lang.InterruptedException at java.util.concurrent.locks.AbstractQueuedSynchronizer$ConditionObject.reportInterruptAfterWait(AbstractQueuedSynchronizer.java:2014) at java.util.concurrent.locks.AbstractQueuedSynchronizer$ConditionObject.await(AbstractQueuedSynchronizer.java:2048) at java.util.concurrent.ArrayBlockingQueue.take(ArrayBlockingQueue.java:403) at db.$EmailNotifierDaemon.run(asdasd.java:1133) Extracted as: DATETIME : 2020-12-07 17:43:02 DAEMON: ABCD_Daemon1 SEV: WARN CLASS: ABCD_CLASS1 MESSAGE: Failed to process java.lang.InterruptedException at java.util.concurrent.locks.AbstractQueuedSynchronizer$ConditionObject.reportInterruptAfterWait(AbstractQueuedSynchronizer.java:2014) at java.util.concurrent.locks.AbstractQueuedSynchronizer$ConditionObject.await(AbstractQueuedSynchronizer.java:2048) at java.util.concurrent.ArrayBlockingQueue.take(ArrayBlockingQueue.java:403) at db.$EmailNotifierDaemon.run(asdasd.java:1133) Event 2: 2020-12-07 16:12:14,273 [ABCD_Daemon2] INFO ABCD_CLASS2 - Got notification for external configuration change, cleaning caches. Extracted as: DATETIME : 2020-12-07 16:12:14 DAEMON: ABCD_Daemon2 SEV: INFO CLASS: ABCD_CLASS2 MESSAGE: Thank you ... View more