About Shariq

Shariq · ‎10-29-2021

single quote did not worked

Shariq · ‎10-28-2021

i did not try _raw earlier but when I did just now,it worked. but still, I am not clear why request-all-header is not working since I can see that this field is getting extracted properly without any rex.

Shariq · ‎10-28-2021

i even tried changing the variable name but no luck

Shariq · ‎10-28-2021

No , it is still not working in Splunk with real event. i can see the events but the query is not doing anything the make result is something I tried in all ways and it works with make result but not with the query with original event. | makeresults | eval Request-all-Headers="Accept - */* Authorization - Bearer m6CsheaxrlMKIBH3vZ0EXk5G3rw6 Content-Type - application/json Host - api.ingrammicro.com IM-CorrelationID - 213.45245849 IM-CountryCode - TN IM-CustomerNumber - 44-999999 IM-SenderID - Global Reward Solutions simulateStatus - IM::SHIPPED X-Forwarded-For - 10.0.0.0X-Forwarded-Port - 123 X-Forwarded-Proto - https" | rex field=Request-all-Headers "IM-CountryCode\s+-\s+(?P<country>[A-Z]{2})" | rex field=Request-all-Headers "IM-CustomerNumber\s+-\s+(?P<custno>[0-9]+-[0-9]{6})" | table Request-all-Headers country custno

Shariq · ‎10-28-2021

i have data as below : Request-all-Headers = Accept - */* Authorization - Bearer m6CsheaxrlMKIBH3vZ0EXk5G3rw6 Content-Type - application/json Host - api.ingrammicro.com IM-CorrelationID - 213.45245849 IM-CountryCode - TN IM-CustomerNumber - 44-999999 IM-SenderID - Global Reward Solutions simulateStatus - IM::SHIPPED X-Forwarded-For - 10.0.0.0X-Forwarded-Port - 123 X-Forwarded-Proto - https and working rex below from regex 101 : IM-CountryCode\s+-\s+(?P<country>[A-Z]{2})\s+IM-CustomerNumber\s+-\s+(?P<custno>[0-9]+-[0-9]{6}) now when I tried the same with splunk. splunk is not able to extract the fields . my splunk query is below : index=test sourcetype="test" | rex field=Request-all-Headers "IM-CountryCode\s+-\s+(?P<country>[A-Z]{2})" | rex field=Request-all-Headers "IM-CustomerNumber\s+-\s+(?P<custno>[0-9]+-[0-9]{6})"

Shariq · ‎11-25-2020

eval coalesce worked well for me without changing the data at ingestion. thanks.

Shariq · ‎11-25-2020

Mydata is like below where the customerNumber can come like CustomerNumber or customernumber or CUSTOMERNUMBER AND isoCountryCode can come as IsoCountryCode, ISOCountryCode or any other combination. Now during field extraction Splunk considers all these fields as seperate. though while writing query i want to consider all these fields as one. Environment = prod-dmz-usch01 | API = testapi| RequestURI = /test/v5/tesdt/10-12345?customerNumber=01-12345&isoCountryCode=US | ProxyRequestFlowName = testDetails-OpenAPIv3GetVerb. My query is as below: index=test sourcetype="testsamples" testapi "ProxyRequestFlowName = testDetails-OpenAPIv3GetVerb" | search isocountrycode=US OR isoCountryCode=US -- this seems to be taking care of multiple values but it is not a good idea to write each field here, how to handle all scenario's ? | bucket _time span="24h" | chart count by customerNumber where count in top100 -- i am able to give only one value of customer number here , how can i handle all use cases ?

Posts	7
Solutions	0
Karma Given	1
Karma Received	1
Member Since	‎11-25-2020

Online Status	Offline
Date Last Visited	‎10-30-2021 07:10 PM

Regex not working on splunk for the expression whi...

way to use case insensitive fields - Not Value

Re: Regex not working on splunk for the expression...

Re: Regex not working on splunk for the expression...

Re: Regex not working on splunk for the expression...

Re: Regex not working on splunk for the expression...

Regex not working on splunk for the expression whi...

Re: way to use case insensitive fields - Not Value

way to use case insensitive fields - Not Value