All my log statements are of below format. { "source": "stdout", "tag": "practice/myapplication:4444a76b917", "labels": { "pod-template-hash": "343242344", "version": "9216a76b917b8258a1ee6de7d3bbf9a78ca59f1f", "app_docker_io/instance": "my-application" }, "time": "1628235185.043", "line": "2021-08-06T07:33:05.043Z LCS traceId=a83a082592cf2275, spanId=a83a082592cf2275 LCE [qtp310090733-278] ERROR c.p.p.c.a.ErrorHandlerAdvice.logErrorDesc(34) - ERROR RESPONSE SENT", "attrs": { "image": "practice/myapplication:4444a76b917", "env": "dev", "region": "local", "az": "us-west" } }   i want to extract the timestamp from beginning of each line and sort my results based on that timestamp. I have no idea of splunk search queries. can someone help? ... View more

i have to replace multiple text strings with different values. e.g. Log Statement:-  "Hello, this is sample url for employees, /company/employee/1 and there is also a sample url for departments like /company/name/department/a1" I have to replace any url's of the format "/company/employee/*" with /company/employee{id} , and url's of format "/company/name/department/*"  with  "/company/name/department/{deptId}" and url's for format "/company/notfound/404" with "/company/notfound/{status}  and so on.. so output will look like below. "Hello, this is sample url for employees, /company/employee/{id} and there is also a sample url for departments like /company/name/department/a1 or /company/name/department/{deptId}" Currently i am using 3 nested replace statements for above example to solve this issue because i don't know how many patterns would exist in the statement so i check all 3 patterns. Nested replace seems like slow and also giving errors like below. has exceeded configured match_limit, consider raising the value in limits.conf. Also my nested replace statements are increasing as i am adding more url formats. this is exactly how i am forming the regex.   | eval apiPath = replace (replace(replace(replace(replace(replace(replace(replace(replace(replace( trimmedUrl, "\/[0-9]{1}[0-9a-z]+\/", "/{id}/" ), "\/[a-z]{1,2}[0-9]{1}[0-9a-z]+\/", "/{id}/" ), "\?.*", "?<my-filters>" ), "\/P-[0-9]+", "/P-{id}" ), "\/car\/[a-z]+\/.*", "/car/{carType}/{id}" ), "\b[0-9a-f]{8}\b-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-\b[0-9a-f]{12}\b", "{uuid}" ), "\/user\/[a-z0-9+\._-]+(@|%2540)[a-z\.-]+\.[a-z]+$", "/user/{email}" ), "\/(jobs|xls)\/[a-z0-9]+", "/\1/{id}" ), "\/org\/.*\/enroll\/status", "/org/{id}/enroll/status" ), "\/car\/[a-zA-Z]+\/[0-9]+$", "/car/{carType}/{id}" ) i want to remove the error and execute the search faster. please suggest couple of different options. thank you ... View more

I am trying to find the top api url's that were consumed by our clients. Our uri in logs are of below format. 1. https://api.server.com/user/1                       (type 1) 2. https://api.server.com/user/2                       (type 1) 3. https://api.server.com/user/3/role/1        (type 2) 4 . https://api.server.com/user?name=test  (type 3) Now i need result count for each uri like below. /user/{id} - 2 /user/{id}/role{id}. - 1 /user   - 1  (or user {filter} for query params e.g. /user/{filter}) i have unlimited combinations of such path parameters for different resources. what is the best way to get the count of url hits.     ... View more

Below is a sample log message.  Each message will have string "500 Server Error for HTTP" and i need to extract 3 fields after the occurrence of "500 Server Error for HTTP" string 2020-11-18T00:32:37.632Z LCS userId=null LCE [helper-http-epoll-1] ERROR o.s.b.a.w.r.e.AbstractErrorWebExceptionHandler.error(122) - 500 Server Error for HTTP POST "/sports/v1/boxing"java.net.UnknownHostException: my-rest-service.backend--> at java.base/java.net.InetAddress$CachedAddresses.get(InetAddress.java:797)--> Suppressed: reactor.core.publisher.FluxOnAssembly$OnAssemblyException: I need to extract 2 fields  - 1) method (e.g. - POST) 2) path (between 1st pair of quotes) - e.g, /sports/v1/boxing and 2)exception_type (anything between 1st quote closing and before first occurrence of -->) java.net.UnknownHostException: alert-rest-service.backend- Splunk query i am trying is below index="k8s*" messageType=ERROR "*Exception:*-->" | rex "500 Server Error for HTTP (?<http_method>\\S+).*\\\\\"(?<resource_url>.*)\\\\\"(?<java_exception>.*?(Exception)).*"  Query works fine to extract "http_method" and "resource_url" but "java_exception" is not being extracted properly. Can someone help? ... View more