Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About RobKelley06
RobKelley06
Explorer
Member since:
06-15-2021
11-27-2023
Community Statistics
| Posts | 12 |
| Solutions | 1 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 06-15-2021 |
Activity Feed
- Posted Re: Using URL parameters to set input. Conditions with match not setting tokens. on Dashboards & Visualizations. 06-25-2021 06:33 AM
- Posted Using URL parameters to set input. Conditions with match not setting tokens. on Dashboards & Visualizations. 06-24-2021 02:03 PM
- Posted Re: Use results of search field value to do subsearch and calculate success percentage on Splunk Search. 06-16-2021 12:02 PM
- Posted Re: Use results of search field value to do subsearch and calculate success percentage on Splunk Search. 06-16-2021 11:58 AM
- Posted Use results of search field value to do subsearch and calculate success percentage on Splunk Search. 06-16-2021 10:02 AM
- Posted rex search not extracting correctly on Splunk Search. 06-15-2021 02:17 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
06-25-2021
06:33 AM
The URL is not the issue. It's the target dashboard not determining the tokens. I have used the exact URL that changing the dropdowns produces in the browser URL and it still doesn't work. I know the URL works correctly because the dropdowns are changing based off of the URL, but the tokens inside the "condition" statements are not being calculated.
... View more
06-24-2021
02:03 PM
I have a link on one dashboard <html>
<a href="....._dashboard?form.dcCell=$dcCell$&form.rhel=$rhel$&form.field1.earliest=$field1.earliest$&form.field1.latest=$field1.latest$">PRD Dashboard</a>
</html> The link is filling out correctly. When I click it and go to the target dashboard, the inputs are being set correctly, but the tokens are not being set at all. Target dashboard <fieldset submitButton="false" autoRun="true">
<input type="dropdown" token="rhel" searchWhenChanged="true">
<label>RHEL Server</label>
<choice value="rhel6">RHEL 6</choice>
<choice value="rhel8">RHEL 8</choice>
<change>
<condition match="match($rhel$,"rhel6") AND match($dcCell$, "allE")">
<set token="use_jcs">True</set>
<set token="use_hikari">True</set>
</condition>
<condition match="match($rhel$,"rhel8") AND match($dcCell$, "allE")">
<set token="use_hikari">True</set>
<unset token="use_jcs"></unset> When using the drop downs, everything works fine. It's only when i try to put the parameters in the url, does it break. I have even tried using the drop downs and the copying the url it generates on the browser and going directly to that. It still does not set the tokens. What am I missing?
... View more
Labels
- Labels:
-
token
06-16-2021
12:02 PM
This seems to give the total success % but if i try to refine the search to add (ou="aems" AND "SRQ") such as: index=soe host=dc1 sourcetype="request" source="/vds_request_*.log" (ou="aems" AND "SRQ") OR "SRS" It will still give the total request % and not just those that the SRQ results are looking for. I need to match the id from SRQ to an id from SRS and only include those results. Also, the total results should only include SRQ total count.
... View more
06-16-2021
11:58 AM
I don't think that works exactly, it doesn't do the 2nd search for the corresponding "SRS" respond to the "SRQ" Request
... View more
06-16-2021
10:02 AM
I am attempting to get the success counts by using the results of a search of requests and checking each result for it's response to see if it was a success. This initial search will save the count as Total. The initial search will have results similar to: 20210616:12:28:49.356;123456;12345;SRQ; I need to extract every thing in the position as "123456;12345" and do a subsearch on each and if there is a result, add 1 to the success count. Then i will display the percent of successes based on the total requests. I have tried: index=soe host=dc1 sourcetype="request" source="/vds_request_*.log" "SRQ" | stats count as Total | eval successes = 0 | rex field=_raw "(([^;]*);)(?<id>\d+;\d+);" | map search="index=soe host=dc1 sourcetype='request' source='/vds_request_*.log' 'SRS;0;' id = $id$" | stats count as success | eval percent = round(success / Total * 100, 3) | table percent I am getting the error Error in 'map': Did not find value for required attribute 'id'. I am new to using map so I know that I'm using it wrong, I just can't see to find what I'm trying to do anywhere.
... View more
Labels
- Labels:
-
subsearch
06-15-2021
02:17 PM
I am trying to extract 2 fields out of the result, but it keeps grabbing the wrong values. Example result: 123456789:17:05:18.865;1234;12345678;SRS;80;null;0;0;1 I want to extract the "80" and the "null" fields. I have tried the following: | rex field=_raw "([^;]*;){4}(?<Code>;)(?<Error>;)([^;]*;){2}" | rex field=_raw "([^;]*;){3}(?<Code>;)(?<Error>;)([^;]*;){2}" | rex field=_raw "([^;]*;)([^;]*;)([^;]*;)([^;]*;)(?<Code>;)(?<Error>;)([^;]*;){2}" | rex field=_raw "([^;]*;)([^;]*;)([^;]*;)(?<Code>;)(?<Error>;)([^;]*;){2}" | rex field=_raw "([^;]*;)([^;]*;)([^;]*;)([^;]*;)(?<Code>;)(?<Error>;)([^;]*;)([^;]*;)" | rex field=_raw "([^;]*;)([^;]*;)([^;]*;)(?<Code>;)(?<Error>;)([^;]*;)([^;]*;)([^;]*;)" Every time the "Code" value is coming as "null" and not "80". What am I missing?
... View more
Labels
- Labels:
-
field extraction
-
rex
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-27-2023
01:25 PM
|
