Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About martinhelgegren
martinhelgegren
Explorer
Member since:
10-27-2020
a month ago
Community Statistics
| Posts | 13 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 1 |
| Member Since | 10-27-2020 |
Activity Feed
- Posted Re: Transaction without endswith on Splunk Search. a month ago
- Posted Transaction without endswith on Splunk Search. 03-25-2024 01:33 AM
- Posted Re: How to match when a certain value/string has occurred more than x times within an interval? on Splunk Search. 01-08-2023 11:50 PM
- Posted Re: How to match when a certain value/string has occurred more than x times within an interval? on Splunk Search. 01-08-2023 11:36 PM
- Posted Re: Match when a certain value/string has occurred more than x times within an interval? on Splunk Search. 01-08-2023 12:19 PM
- Posted Re: Match when a certain value/string has occurred more than x times within an interval? on Splunk Search. 12-14-2022 01:25 PM
- Posted How to match when a certain value/string has occurred more than x times within an interval? on Splunk Search. 12-13-2022 01:41 PM
- Karma Re: REX parenthesis and end of line for johnhuang. 12-04-2021 12:18 AM
- Got Karma for Re: REX parenthesis and end of line. 12-04-2021 12:11 AM
- Posted Re: REX parenthesis and end of line on Splunk Search. 12-04-2021 12:05 AM
- Posted Re: REX parenthesis and end of line on Splunk Search. 12-03-2021 02:30 PM
- Posted Re: REX parenthesis and end of line on Splunk Search. 12-03-2021 02:26 PM
- Posted Re: REX parenthesis and end of line on Splunk Search. 12-03-2021 01:47 PM
- Posted REX parenthesis and end of line on Splunk Search. 12-03-2021 01:18 PM
- Posted Use of checkbox to govern annotations on Dashboards & Visualizations. 10-27-2020 02:33 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
a month ago
Unfortunately no, tested them both - separately with each boolean value and together with both true/true, true/false, false/true and false/false. Does not seem to provide the matching needed.
... View more
03-25-2024
01:33 AM
Hi! Filtering data from an amount of hosts looking for downtime durations. I get a "forensic" use view with this search string:
index=myindex host=* | rex "to state\s(?<mystate>.*)" | search mystate="DOWN " OR mystate="UP | transaction by host startswith=mystate="DOWN " endswith=mystate="*UP " | table host,duration,_time | sort by duration | reverse
...where I REX for the specific patterns of "to state " (host transition into another state, in this example "DOWN" or "UP"), I had do do another "search" to get only the specific ones as there are more than DOWN/UP states (due to my anonymization of the data). I then can retrieve the duration between transitions using "duration" and sorting it as I please. My question - if I'd like to look into ongoing, "at-this-moment-active" hosts in state "DOWN" ie. replace "endswith" with a nominal time value ("NOW"). Where there yet has not been any "endswith" match, just counting the duration from "startswith" to the present moment - any tips on how I can formulate that properly?
... View more
Labels
- Labels:
-
transaction
01-08-2023
11:50 PM
Did a quick test and I don't think this would be a better solution for my target, sorry...
... View more
01-08-2023
11:36 PM
Thank you for your efforts! I did get somewhere near target using this strategy I found on another thread yesterday: </ | bin _time span=5m | stats count AS state_changes by _time | eval occurrence=if(state_changes!=0, 1, 0) | where state_changes > 50 > ...though the eval occurrence is pretty much useless as I do not care about the number of occurences and this only ever shows 1 and never 2. This produces the results as a table with _time, amount of state changes and the obsolete occurences. It achieves the main purpose which is identifying all the "buckets" (intervals) with "more than x times". The next task is to try to figure out how to use the matched events in eg. an annotation or something else in the timeline, or even setup some kind of triggering. I will however try out our strategy during the day and see where it leads! Will keep you posted!
... View more
01-08-2023
12:19 PM
Hi! Adding a bucket does something but it seems I can't match all the data properly. I will need to reply with some some details of how the text and search strings are built when I have the opportunity to. Please be patient...
... View more
12-14-2022
01:25 PM
I have tried the suggested functions and while the first part: | streamstats global=f current=f latest(state) as previous by host ...provides another column with the previous value of the matched field the full formula doesn't match anything no matter which interval I try . I've tried 1,5 and 60 minutes. I also can't interpret the syntax of the functions mentioned, where does the amount of hosts come in? What is the minimum triggering amount of hosts? Grateful for the help!
... View more
12-13-2022
01:41 PM
Hi!
I have various syslog clients sending me logs about their current state (a certain process). Eg.
[timestamp] host1 is in state "yes" [timestamp] host2 is in state "yes" [timestamp] host1 is in state "no" [timestamp] host2 is in state "no"
When ever a state transition occurs randomly and at a low "rate" I don't care but I want to find and match when more than x hosts has logged the same state transition from "yes" to "no" (or vice versa) within a certain time interval eg. 60s. Kind of a "sliding window" idea where only chunks of/groups of the same value during a short period of time is of interest to me. Of course - thus far I've only managed to visualize the "peaks" but unfortunately the peaks are rather anonymous. They don't stand out. Any ideas where to start? Which attributes in SPLUNK search may present such desirable function?
... View more
12-04-2021
12:05 AM
1 Karma
(re-write my reply to solution) Bingo! It turns out all but Multivalue Match works like a charm and the explanation should lie in whitespaces in the strings. The rex string needs to look like this: | rex"\((?<result>[^\)]+)\)\s+?$" I completed the search with a simple table: | table host,time,result Some day I too shall understand why some fields or predefined values needs a prepended underscore...like "_time" (while "host" does not...) Thank you all for contributing! You are a part of the drive force!
... View more
12-03-2021
02:30 PM
By the way - I have also tried to extract the value using Field Extractor but then I don't get matches for ALL possible values, I have tried many times using different samples etc. and the best way thus far is extracting two fields using two different regex compilations assembled by the SPLUNK Field Extractor guide itself. But listing them forces me to return duplicates and sometimes a false value as it results in a prev. value found earlier (not at the end) in the line.
... View more
12-03-2021
02:26 PM
Yes, both regex101.com and the makeresults info you pasted does indeed work in my SPLUNK system. But appending: | rex "\((?<result>[^\)]+)\)$" ...to my search and trying to print the actual results are returning "result=null" according to SPLUNK. I get the timestamps right when adding "_time" to my printing attempts. Maybe the REX is indeed valid but I'm simply using wrong method in trying to print it. After I have a matched REX result I want to print a Field (already extracted - in this case a hostname), time (timestamp of the entered log message) and the actual REX result (eg. Line GigabitEthernet0/0/0/0) on a single row/line. Any help on how to table or chart or anything else I can use to perform it?
... View more
12-03-2021
01:47 PM
Sorry - no luck. Also the [^\)]+) included (basically added to what I already tried: | rex "\((?<result>)\)$" ...where \( is literal (?<result>) is my intended result match followed by ) as literal $ at end of line/string. What would be the intention of matching ^\) one or more times? Here's a more true sample line and I want the bold value between parenthesis (with or without including them - doesn't matter): New selection for selection point 1588-SEL: 1 inputs selected: input from Selection 0/0/CPU0-ETH_RXMUX(1) (Line GigabitEthernet0/0/0/0)
... View more
12-03-2021
01:18 PM
Hi! Been struggling a lot with a pretty simple problem but my SPLUNK REX skills are insufficient for the task. I want to match and list ANY value containing both letters, digits and characters between parenthesis at the end of line/end of string - examples: bla bla bla (My Value0/0) bla bla blb (My OtherValue0/1) bla blb blc (My thirdValue0/0/0/0) As you can see - the text BEFORE the ending value inside parenthesis can be what ever. There can also be MULTIPLE similar values also within parenthesis along the string but I ONLY want to match the one at end of line ($). The match must be every letter, space, number or typically "/" characters between the parenthesis. Using other regex dev tools I get a fairly decent result with a simple string like this: \(.*\)$ \( matches the character ( with index 4010 (2816 or 508) literally (case sensitive) . matches any character (except for line terminators) * matches the previous token between zero and unlimited times, as many times as possible, giving back as needed (greedy) \) matches the character ) with index 4110 (2916 or 518) literally (case sensitive) $ asserts position at the end of a line I also have used variants of this and they all end up working very well in regex testers and dev tools and also in LINUX (when pasting the entire table of messages into a file and applying them. But not in SPLUNK - I believe there is a big coin drop along my SPLUNK use path when everything will make sense to me, unfortunately not there yet. Please help me out!
... View more
10-27-2020
02:33 PM
Been Googling (as a novice user of SPLUNK) for a while in search of an answer but haven't had the luck so I'll try posting a Q. I'm using annotations in-line with timecharts in various searches. The UI source looks like this: <search id="base_annotation"> <query>index=my_index | eval My_value = 'host' + " " + 'another_field' | eval annotation_label = Host_value</query> <earliest>$timefield.earliest$</earliest> <latest>$timefield.latest$</latest> </search> I then add the resulting base_annotation into the relevant timecharts of my dashboard using: </search> <search type="annotation" base="base_annotation"> <query></query> </search> ...beneath the original query. This works well but I'd like to make the annotations optional to the users. Hence I'd imagine there is a way to let a checkbox govern the presence of annotation in the timecharts ie. if the checkbox is checked then keep the code as is, if un-checked then run the searches without the search type="annotation". Any hints anyone? Kind regards
... View more
