I have a log entry with the current format:    field=A_B   (delimited by underscore) How can I extract this data into two different fields so that I can create a table  field1 field2 A B ... View more

I have the following log:      Requests over Threshold found: {"kv":{"top_requests":[{"operation_name":"get","last_dispatch_duration_us":136231,"last_remote_socket":"xx","last_local_id":"67B57F7300000001/00000000C1E2DBA3","last_local_socket":"xxx:37894","total_dispatch_duration_us":136231,"total_server_duration_us":3,"operation_id":"0x127f1","timeout_ms":250,"last_server_duration_us":3,"total_duration_us":136516},{"operation_name":"get","last_dispatch_duration_us":135914,"last_remote_socket":"xxx","last_local_id":"67B57F7300000001/00000000C1E2DBA3","last_local_socket":"xxx:37894","total_dispatch_duration_us":135914,"total_server_duration_us":15,"operation_id":"0x127e9","timeout_ms":250,"last_server_duration_us":15,"total_duration_us":135985},{"operation_name":"get","last_dispatch_duration_us":135827,"last_remote_socket":"xxx.xxx:11210","last_local_id":"67B57F7300000001/000000006A92D90B","last_local_socket":"xxx:59306","total_dispatch_duration_us":135827,"total_server_duration_us":15,"operation_id":"0x127e7","timeout_ms":250,"last_server_duration_us":15,"total_duration_us":135946}],"total_count":3}}     How can I parse this?  ... View more

I have the following queries      query 1 : index1 .... | table _time uniqueID query 2 : index2 .... | table _time uniqueID   And I am trying to find events where the uniqueID is found in both AND the the subtraction between the time is greater than N milliseconds    Ideally, the output should be something like :    uniqueID System 1 time System 2 time Difference in Millis 123 Time 1 Time 2 500 1234 Time 11 Time 22 60   Could you please help? ... View more

I have the following data :    Service Message Service1 Hello world Service2 Another message Service1 Hello world Service1 Some other message   How can I write a query such that the final output looks like :  Service : Unique message : count For example :  Service1 : Hello World :   2 Service1:Some other message : 1 Service2: Some other message ... View more

I have the following data :    Service Message Service1 Hello world Service2 Another message Service1 Hello world Service1 Some other message   How can I write a report such that the final output looks like :  Service Message : count   For example, with the data above, it should be :  Service1 Hello world : 2 Some other message : 1 Service 2 Another message : 1 ... View more

Considering a field like :  field=select id from table where id In ["123","12"] limit 1 field=select id from table where id="123" limit 1   How can I write a query so that all the values in quotes are replaced by a placeholder? For example, an ideal output would be :  field=select id from table where id In ["xxx","xx"] limit  field=select id from table where id="xxx" limit 1   The values within quotes are alphanumeric ... View more

I have the following data :  query="select field  from table where (status!="Y")  and ids.id IN ["123","145"] limit 500" params="{}" How can I extract the field query ignoring the special characters?  My query .... | table query params Is cut off when it reaches the status field.  How can I extract everything regardless of the special characters?  Is there any recommended format that I should change my logs to make them easier to parse?   ... View more

I have the following log that Splunk is not recognizing well : msg=id=123342521352 operation=write   How can I write a query so that ID is parsed by itself? The goal is to be able to build a table like : id operation 123342521352 write   Unfortunately, when I tried table id operation The id is always empty as it does not seem to be parsed correctly ... View more