About martinhelgegren

martinhelgegren · ‎03-26-2024

Unfortunately no, tested them both - separately with each boolean value and together with both true/true, true/false, false/true and false/false. Does not seem to provide the matching needed.

martinhelgegren · ‎03-25-2024

Hi! Filtering data from an amount of hosts looking for downtime durations. I get a "forensic" use view with this search string: index=myindex host=* | rex "to state\s(?<mystate>.*)" | search mystate="DOWN " OR mystate="UP | transaction by host startswith=mystate="DOWN " endswith=mystate="*UP " | table host,duration,_time | sort by duration | reverse ...where I REX for the specific patterns of "to state " (host transition into another state, in this example "DOWN" or "UP"), I had do do another "search" to get only the specific ones as there are more than DOWN/UP states (due to my anonymization of the data). I then can retrieve the duration between transitions using "duration" and sorting it as I please. My question - if I'd like to look into ongoing, "at-this-moment-active" hosts in state "DOWN" ie. replace "endswith" with a nominal time value ("NOW"). Where there yet has not been any "endswith" match, just counting the duration from "startswith" to the present moment - any tips on how I can formulate that properly?

martinhelgegren · ‎01-08-2023

Did a quick test and I don't think this would be a better solution for my target, sorry...

martinhelgegren · ‎01-08-2023

Thank you for your efforts! I did get somewhere near target using this strategy I found on another thread yesterday: </ | bin _time span=5m | stats count AS state_changes by _time | eval occurrence=if(state_changes!=0, 1, 0) | where state_changes > 50 > ...though the eval occurrence is pretty much useless as I do not care about the number of occurences and this only ever shows 1 and never 2. This produces the results as a table with _time, amount of state changes and the obsolete occurences. It achieves the main purpose which is identifying all the "buckets" (intervals) with "more than x times". The next task is to try to figure out how to use the matched events in eg. an annotation or something else in the timeline, or even setup some kind of triggering. I will however try out our strategy during the day and see where it leads! Will keep you posted!

martinhelgegren · ‎01-08-2023

Hi! Adding a bucket does something but it seems I can't match all the data properly. I will need to reply with some some details of how the text and search strings are built when I have the opportunity to. Please be patient...

martinhelgegren · ‎12-14-2022

I have tried the suggested functions and while the first part: | streamstats global=f current=f latest(state) as previous by host ...provides another column with the previous value of the matched field the full formula doesn't match anything no matter which interval I try . I've tried 1,5 and 60 minutes. I also can't interpret the syntax of the functions mentioned, where does the amount of hosts come in? What is the minimum triggering amount of hosts? Grateful for the help!

martinhelgegren · ‎12-13-2022

Hi! I have various syslog clients sending me logs about their current state (a certain process). Eg. [timestamp] host1 is in state "yes" [timestamp] host2 is in state "yes" [timestamp] host1 is in state "no" [timestamp] host2 is in state "no" When ever a state transition occurs randomly and at a low "rate" I don't care but I want to find and match when more than x hosts has logged the same state transition from "yes" to "no" (or vice versa) within a certain time interval eg. 60s. Kind of a "sliding window" idea where only chunks of/groups of the same value during a short period of time is of interest to me. Of course - thus far I've only managed to visualize the "peaks" but unfortunately the peaks are rather anonymous. They don't stand out. Any ideas where to start? Which attributes in SPLUNK search may present such desirable function?

martinhelgegren · ‎12-04-2021

(re-write my reply to solution) Bingo! It turns out all but Multivalue Match works like a charm and the explanation should lie in whitespaces in the strings. The rex string needs to look like this: | rex"$(?<result>[^$]+)\)\s+?$" I completed the search with a simple table: | table host,time,result Some day I too shall understand why some fields or predefined values needs a prepended underscore...like "_time" (while "host" does not...) Thank you all for contributing! You are a part of the drive force!

martinhelgegren · ‎12-03-2021

By the way - I have also tried to extract the value using Field Extractor but then I don't get matches for ALL possible values, I have tried many times using different samples etc. and the best way thus far is extracting two fields using two different regex compilations assembled by the SPLUNK Field Extractor guide itself. But listing them forces me to return duplicates and sometimes a false value as it results in a prev. value found earlier (not at the end) in the line.

martinhelgegren · ‎12-03-2021

Yes, both regex101.com and the makeresults info you pasted does indeed work in my SPLUNK system. But appending: | rex "$(?<result>[^$]+)\)$" ...to my search and trying to print the actual results are returning "result=null" according to SPLUNK. I get the timestamps right when adding "_time" to my printing attempts. Maybe the REX is indeed valid but I'm simply using wrong method in trying to print it. After I have a matched REX result I want to print a Field (already extracted - in this case a hostname), time (timestamp of the entered log message) and the actual REX result (eg. Line GigabitEthernet0/0/0/0) on a single row/line. Any help on how to table or chart or anything else I can use to perform it?

martinhelgegren · ‎12-03-2021

Sorry - no luck. Also the [^\)]+) included (basically added to what I already tried: | rex "$(?<result>)$$" ...where $ is literal (?<result>) is my intended result match followed by ) as literal $ at end of line/string. What would be the intention of matching ^$ one or more times? Here's a more true sample line and I want the bold value between parenthesis (with or without including them - doesn't matter): New selection for selection point 1588-SEL: 1 inputs selected: input from Selection 0/0/CPU0-ETH_RXMUX(1) (Line GigabitEthernet0/0/0/0)

martinhelgegren · ‎12-03-2021

Hi! Been struggling a lot with a pretty simple problem but my SPLUNK REX skills are insufficient for the task. I want to match and list ANY value containing both letters, digits and characters between parenthesis at the end of line/end of string - examples: bla bla bla (My Value0/0) bla bla blb (My OtherValue0/1) bla blb blc (My thirdValue0/0/0/0) As you can see - the text BEFORE the ending value inside parenthesis can be what ever. There can also be MULTIPLE similar values also within parenthesis along the string but I ONLY want to match the one at end of line ($). The match must be every letter, space, number or typically "/" characters between the parenthesis. Using other regex dev tools I get a fairly decent result with a simple string like this: $.*$$ $ matches the character ( with index 4010 (2816 or 508) literally (case sensitive) . matches any character (except for line terminators) * matches the previous token between zero and unlimited times, as many times as possible, giving back as needed (greedy) $ matches the character ) with index 4110 (2916 or 518) literally (case sensitive) $ asserts position at the end of a line I also have used variants of this and they all end up working very well in regex testers and dev tools and also in LINUX (when pasting the entire table of messages into a file and applying them. But not in SPLUNK - I believe there is a big coin drop along my SPLUNK use path when everything will make sense to me, unfortunately not there yet. Please help me out!

martinhelgegren · ‎10-27-2020

Been Googling (as a novice user of SPLUNK) for a while in search of an answer but haven't had the luck so I'll try posting a Q. I'm using annotations in-line with timecharts in various searches. The UI source looks like this: <search id="base_annotation"> <query>index=my_index | eval My_value = 'host' + " " + 'another_field' | eval annotation_label = Host_value</query> <earliest>$timefield.earliest$</earliest> <latest>$timefield.latest$</latest> </search> I then add the resulting base_annotation into the relevant timecharts of my dashboard using: </search> <search type="annotation" base="base_annotation"> <query></query> </search> ...beneath the original query. This works well but I'd like to make the annotations optional to the users. Hence I'd imagine there is a way to let a checkbox govern the presence of annotation in the timecharts ie. if the checkbox is checked then keep the code as is, if un-checked then run the searches without the search type="annotation". Any hints anyone? Kind regards

Posts	13
Solutions	0
Karma Given	1
Karma Received	1
Member Since	‎10-27-2020

Online Status	Offline
Date Last Visited	‎03-26-2024 01:57 PM

Transaction without endswith

How to match when a certain value/string has occur...

REX parenthesis and end of line

Use of checkbox to govern annotations

Re: Transaction without endswith

Transaction without endswith

Re: How to match when a certain value/string has o...

Re: How to match when a certain value/string has o...

Re: Match when a certain value/string has occurred...

Re: Match when a certain value/string has occurred...

How to match when a certain value/string has occur...

Re: REX parenthesis and end of line

Re: REX parenthesis and end of line

Re: REX parenthesis and end of line

Re: REX parenthesis and end of line

REX parenthesis and end of line

Use of checkbox to govern annotations

Are you a member of the Splunk Community?