×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
bcalder
New Member
Member since: ‎10-07-2020
‎03-02-2021
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎10-07-2020
Activity Feed
Topics I've Started
View All

Re: Get instance name from source

by in Splunk Search
‎03-01-2021 08:54 AM
‎03-01-2021 08:54 AM
Thanks @richgalloway That worked great. I ended up with  index=* "Initiating EnterpriseOne startup" | rex "targets\\\(?<machine>[^\\\]+)" | table machine _time | dedup machine | sort machine   As  newbie, I appreciate your input. I'm sure there is documentation out there somewhere. Now if I can just find it. ;^o   Bruce ... View more

Get instance name from source

by in Splunk Search
‎03-01-2021 06:50 AM
‎03-01-2021 06:50 AM
Hi all, I am completely new to Splunk so I apologize if this has been asked/answered. I did review the past discussions but could not find a solution to my question. I have incoming logs that look similar to this 28 Feb 2021 13:53:23,815[MANDATORY][JAS]Initiating EnterpriseOne startup using configuration location (default_path) as 'C:\jde_home\SCFHA\targets\HTML_PD1_82\config'.   I would like to be able to search for the string "Initiating EnterpriseOne startup " and create a dashboard table showing the date, time and the substring HTML_PD1_82. The idea being, I would like to keep track of when each machine was restarted.   Can anyone help with the Search pattern? Thanks in advance.  Bruce ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎03-02-2021 08:11 AM