About jboustead

jboustead · ‎01-08-2021

I am using the same timechart search query: 'search | timechart span=1d sum(xxx)" when I set the time range picker to yesterday preset I get a different value to when I change the time to 'week to date' and view the stats table the value for yesterday - could there be a reason for this?

jboustead · ‎11-17-2020

Is it possible to run a search that will only include all the events for that day after a certain time? (using the time range picker to select the date only, so the time will be selected using the search query) For example I am wanting the search to pick events after 8am for the day selected by the time range picker,

jboustead · ‎11-17-2020

Please help create a Regex that will only take the 4 characters/number after MTCP from below events? For example below, the regex should pick up YUM3, WOPP, WOLG. /XXX/XXXXX/XXXX/XXXXX/MFG_MTCPYUM3..XX_YUM3_XXXX /XXX/XXXXX/XXXX/XXXXX/MFG_MTCPWOPP..XX_WOPP_XXXX /XXX/XXXXX/XXXX/XXXXX/MFG_MTCPWOLG..XX_WOLG_XXXX Thanks

jboustead · ‎11-16-2020

Hi Is there a search command that will ignore the most recent X number of events for each day whilst using a Timechart command? Thanks

jboustead · ‎11-12-2020

Hi, Is it possible to get splunk to search for a query and not include the last X number of events? thanks,

jboustead · ‎11-10-2020

I am looking to count the number of events that occur before and after a specified time (8am) each day to give a table like for example: Events before 8am Events after 8am 400 50 Any help greatly appreciated?

jboustead · ‎10-08-2020

That is correct, however - I am also wanting to include other strings such as: _20201007061717_20201007_txn.zip _20201007092933_20201007_stl.zip Basically to include any string that does not contain _reg after the date...

jboustead · ‎10-08-2020

Thank you for your quick response. Is it possible to expand that regex so that it picks up string without 'reg' following the '_' or '.'? For example: So it would pick up: _20201007103200_20201007.zip but would not pick up: _20201007144100_20200416_reg.zip

jboustead · ‎10-08-2020

That is great - thanks ! I am currently trying to use a regex to pick out the events with the date '2020XXXX' - I want the regex to search pick up any event date providing it does not have 'reg' following the '.' or '_' (pick out all the event dates below, except the first). How do I do this? Current regex: 2020\d{4}[\.\_] List of different events\logs from the splunk search: _20201007144100_20200416_reg.zip _20201007103200_20201007.zip _20201007095000_20201007.zip _20201007092933_20201007.zip _20201007061717_20201007_txn.zip _20201007041719_20201007.zip @Anonymous

jboustead · ‎10-08-2020

I am currently trying to use a regex to pick out the events with the date '2020XXXX' - I want the regex to search pick up any event date providing it does not have 'reg' following the '.' or '_' (pick out all the event dates below, except the first). How do I do this? Current regex: 2020\d{4}[\.\_] List of different events\logs from the splunk search: _20201007144100_20200416_reg.zip _20201007103200_20201007.zip _20201007095000_20201007.zip _20201007092933_20201007.zip _20201007061717_20201007_txn.zip _20201007041719_20201007.zip

jboustead · ‎10-06-2020

My search is pulling out events with the date embedded within the event, eg: [2020-10-05 07:23:08.308] ALL **** sending file= /u01/shared/pc/files/OUT/IF_148/Transferring/XXX_XXXXXX..XX_LUIS_312XXX_20201005_001.csv [2020-10-05 13:40:17.101] ALL **** sending file= /u01/shared/pc/files/OUT/IF_148/Transferring/XXX_XXXXXX..XX_EDIW_312XXX_20200721_003.CSV The embedded dates in the format '202001005' & '202001005' respectively. Is there a way to search in Splunk for events that will only pick up the events for a certain date embedded within them? - without having to manually alter the search each time? (current search for ref: **** sending file= /u01/shared/pc/files/OUT/IF_148/Transferring/*312*)

Posts	11
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎10-06-2020

Online Status	Offline
Date Last Visited	‎01-08-2021 05:16 AM

Timechart sum search query

Search for events after a certain time

Regex Help

How to ignore the most recent X number of events f...

Splunk search query (not including the last x numb...

Event count before and after a specified time

Regex help

Finding embedded dates for an automated search