About Emp

Emp · ‎08-11-2021

I didn't know the "makeresults" command. Seems easier to check with this. On my side, my request is a bit more complicated but in the end, my "diff" column was still empty with this exact command |eval difference=end-start. With your confirmation that the request was working correctly, I found the solution and it was a simple mistake... My "eval" command was before the "table" command and couldn't work. I changed the order and now it's working perfectly. It wasn't so much but thanks, it helps me a lot to clear my mind 😉

Emp · ‎08-10-2021

Hi, I tried to find answers on the forum but I didn't find any working solutions. I had two fields with "hour / minute / second" like: TReceived > 17:13:10 TSent > 17:12:20 I'm trying to substract TSent from TReceived and put it into a table. I did something like : | eval start=strptime(TSent, "%H:%M:%S.%N"), end=strptime(TReceived, "%H:%M:%S.%N") | eval difference=end-start |table end,start,difference As a result, I correctly have something on the "end" and "star" column but "difference" stays empty. Am I missing something? Thanks.

Emp · ‎04-21-2021

I didn't know the coalesce command. Works perfectly now with that. I just had to modify my dashboards. Thank you very much!

Emp · ‎04-20-2021

Case 1: 16434800 SERVER6 67965 SND_OK 0000 NbF=1;XXXRD.NN0015.67965.SERVER1; Case 2: 16434800 SERVER6 67965 SND_OK 0000 X00700086; In both case, what's in bold is my <Rtn> In case one, your first solution works perfectly but not on the case 2.

Emp · ‎04-20-2021

Hi! Yes it's working. I had a strange bug, I modified <Rtn> by <alias> and it didn't work. Changed it again by <Rtn> or <Alias> or something else and it works... So thank you, unfortunately I didn't expect that I could have data with a different format... It works perfectly with: 16434800 SERVER6 67965 SND_OK 0000 NbF=1;XXXRD.NN0015.67965.SERVER1; but of course not when I have: 16434800 SERVER6 67965 SND_OK 0000 X00700086; I'm trying to create a "or" with a | but I'm still in pain with regex 😄

Emp · ‎04-19-2021

Hi! It's not working as expected. It gave me in results: NbF=1;XXXRD.NN0015.67965.SERVER1; What I need is "NN0015". I will continue to search with your solution, I can maybe do something with it 🙂

Emp · ‎04-16-2021

Hi, I'm kind of new on the Splunk world and I'm trying to create new extraction field. Here are two examples of my logs. 14394300 SERVER1 02772 SND_OK 0000 NbF=1;TEST2N.02503.02772.SERVER2; 16434800 SERVER6 67965 SND_OK 0000 NbF=1;XXXRD.NN0015.67965.SERVER1; I don't know how to extract the information in bold. My extract/transform looks like this: (?P<time>\d+)\s+(?P<sdr>\w*)\s+(?P<seq>[^ ]*)\s+(?P<status>[^ ]+)\s+(?P<errorCode>\d+)\s+(?P<Rtn>.+) My fields work correctly for my use (and different cases) but now, I'm trying to be more accurate for <Rtn> <Rtn> now is: NbF=1;XXXRD.NN0015.67965.SERVER1; What I need is just the NN0015 or 02503. I tried with "positive lookbehind" or "positive lookahead" without any success. Is it possible to have some help? Thanks!

Posts	7
Solutions	0
Karma Given	3
Karma Received	0
Member Since	‎04-16-2021

Online Status	Offline
Date Last Visited	‎08-11-2021 03:34 AM

How to substract two fields on epoch

Issue with regex and 'positive lookbehind'

Re: How to substract two fields on epoch

How to substract two fields on epoch

Re: Issue with regex and 'positive lookbehind'

Re: Issue with regex and 'positive lookbehind'

Re: Issue with regex and 'positive lookbehind'

Re: Issue with regex and 'positive lookbehind'

Issue with regex and 'positive lookbehind'