I have log entries that have the following format : [<connectorName>|<scope>]<sp> The following are examples of the connector context for a connector named "my-connector": [my-connector|worker] [other-connector|task-0] [my-connector|task-0|offsets] I would like to extract the name of the connectors and build stats. The tasks or other metadata are not needed. For example : Connector Count my-connector 2 other-connector 2   As the entries have different formats, how can I do this? ... View more

I am currently running a query that is quite inefficient, and it fails when run for extended periods. Splunk only allows me to run it every 15 minutes, which is a limitation I have as a work around for now. Unfortunately, I can't improve the situation because I don't have control over the log creation process as the logs come from a third party system Currently, I'm running the query as an alert every 15 minutes, but I'd like to capture these metrics over a more extended period, such as 24 hours or more. Is there a built-in mechanism in Splunk that can store and append the results of these queries for future reference? I am aware that I could use the Java SDK to extract and aggregate the metrics outside of Splunk, but that approach is not ideal. ... View more

When I run the following query:  "com.server" | table id uri statusCode _time | join type=inner saga_id [search "SecondServer" path="/myPath/*" | tablepath, id | where statusCode >= 400 | stats count by uri,statusCode,path | sort -count Over the last 15 minutes, it returns results. When I run it over a longer time range like 60 min or last 24h, it does not I am puzzled by this and I am not sure what I am doing wrong. Could you please help?    ... View more

I have the following queries:          index=myIndex app_name IN (my-app-a, my-app-b) process=end | eval app_name = replace(app_name, "-[ab]$", "") | where match(status, "^[45][0-9]{2}$") AND in(status, "500", "503", "504") | timechart count by status index=myIndex method!=GET process="start" app_name IN (my-app-a, my-app-b) process=end | eval app_name=replace(app_name, "-[ab]$", "") | timechart count | timechart per_second(*)     Where the first query returns the numbers of errors over time and the second query the requests per second   Even if there are no errors, it should paint a graph with 0 and still include the requests per second. The end goal is to be able to compare the requests per second/error ratio     How can I combine these two into a single chart with two separate graphs? My best attempt :  index=myIndex app_name IN (my-app-a, my-app-b) process=end | eval app_name = replace(app_name, "-[ab]$", "") | where match(status, "^[45][0-9]{2}$") AND in(status, "500", "503", "504") | timechart span=1h count as error_count | append [search index=myIndex app_name IN (my-app-a, my-app-b) process=end | eval app_name=replace(app_name, "-[ab]$", "") | timechart span=1h count as requests_per_hour | fields _time, requests_per_hour] | stats sum(error_count) as error_count sum(requests_per_hour) as requests_per_hour by _time | sort -requests_per_hour   Is there any other way to do this? ... View more

I calculate the requests per second for my application using the following query:      method!=GET process="start" | timechart count by region limit=0 | timechart per_second(*)   I also calculate the number of errors my application is producing using the following separate query     process=end AND status=500 | timechart count | timechart per_second(*)     I am trying to find a query that will answer when my application "breaks", or in other words, what is the requests per second that causes my application to have more than N errors     ... View more

I have the following log :  data=123 params="{"limit":200,"id":["123"] someotherdata   How can I parse the params field to a table so that the final output is    data params 123 "{"limit":200,"id":["123"]   if I try table data params   It ends up being :    data params 123 {   ... View more