About Marco204

Marco204 · ‎08-22-2022

Hi there, so I have a search which contains the field myMetric (done within field extraction). I want to show a dashboard panel presenting only myMetrics on the y-axis and time on the x-axis. I fail using "| timechart" since I am forced to use a statistic function or count (I want to show myMetric, not the count). Using "| eventstats" my first problem was that the dashboard legend shows way to many fields, but I was able to remove them using "| fields -a,b,c". But the x-axis is labeled with "Time" instead of showing concrete datetimes. So how can I archive this?

Marco204 · ‎03-03-2022

Well, that was pretty straight forward @PickleRick 🙂 So I was able to do it within the SPL: mainsearch | eval mvExtractedParam=split(extractedParam, ",") And I was able to create a field transformation using "extractedParam" as the value for Source Key and the easy Regular expression: (?<mvExtractedParam>\w+) Thanks a lot, Marco PS: never forget to create a field extraction that uses the field transformation, just for the purpose of enabling it...

Marco204 · ‎03-03-2022

Hi there, so I have a line of log like this: http://some.url/path/?param=x,y,z So I want to extract a field "extractedParam" with the value "x,y,z". Then I want to extract the three values into a multivalue field "mvExtractedParam". Within Splunk Cloud I will use a field extraction with the following regex which is wrapped up by a field transformation (here I can check "Create multivalued fields"). So I try to do everything within one regex, but here I am struggling. \?param=(?<extractedParam>.*) This extracts "x,y,z". Right now I dont know how to chain the next step... All the best, Marco

Marco204 · ‎04-28-2021

Thanks a lot for your answer. In between I was able to combine field transformation and field extraction, so right now I have the variable named MARCO. In a search over the last 30 day there occur 3 values: 200, 204 and 400. But using your where-clause returns no results at all. And the 2nd param of the mvfind function is a regex, so it has to be quoted. Here some results: | where isnull(mvfind(MARCO,"204")) return the 200 and 400. | where isnull(mvfind(MARCO,"400")) return the 200 and 204. | where isnull(mvfind(MARCO,"200")) return 0 events. 🙄 So now I need to explain the results a normal search without where-clause. 200,204,200 200 200,204 200,400 200,200,204 So somehow there is always a 200, and removing those results in 0 events. Do you know another way of filtering? Currently I want the (200,400) and maybe in the future I will get something like (200,500) or (200,404) which I also want... Best regards, Marco

Marco204 · ‎04-27-2021

Hi there, so I have a search that results contains multiple occurences of one field. My current solution is using rex together with max_match=0 in order to get this: index="dev_logs" pod::apollo* some.url.com/api statusCode | rex field=_raw max_match=0 "\"statusCode\":(?<ApolloStatusCode>\d+)" Well, right now I want an alert for the case that status is neither 200 nor 204. So I played around with this: | search 200 OR search 204 | search NOT 200 AND search NOT 204 | search NOT [search 200 OR search 204] To be honest neither works 🤔 Right now I think that the sub-search is the problem, and a solution could be to use field-extraction. So I used the field extraction wizard and changed the generated regex to this afterwards: "statusCode":(?<ApolloStatusCode>\d+) But this only returns the first occurence - but I need them all. With field transformation I didn't make any progress, and editing some conf files are out of scope... Thanks for any help, Marco

Posts	5
Solutions	1
Karma Given	6
Karma Received	0
Member Since	‎04-27-2021

Online Status	Offline
Date Last Visited	‎08-23-2022 07:29 AM

How to present eventstats as timechart?

How to get a field extraction of a field extractio...

multiple occurences of one field - from rex to fie...

How to present eventstats as timechart?

Re: field extraction of a field extraction

How to get a field extraction of a field extractio...

Re: multiple occurences of one field - from rex to...

multiple occurences of one field - from rex to fie...

Join the Conversation