Hi All I have a search string ... index="ee_apigee" vhost="rbs" uri="/eforms/v1.0/cb/*" | rex "(?i) .*?=\"(?P<httpstatus>\d+)(?=\")" | bucket _time span=day | stats count by _time, httpstatus | eventstats sum(count) as total | eval percent = (count/total)*100 . " %" | fields - total ...whose percent field is showing a percentage over entire period searched and not just the 'day'.  How can above be modified to give percentage per day for each httpstatus? ... View more

Hi All, We have an application that gets events in from an external party but occasionally we see out of sequence events that occur due to underlying issues with the MQ interface [guaranteed delivery but not necessarily in correct order].  Identifying out of sequence events would then point to an issue with the underlying MQ.  Given this set of data.. | makeresults format=csv data="timelogged, formDataId, eventOrder 00:02,AA,2 00:03,AA,3 00:04,AA,3 00:05,AA,4 00:06,AA,5 00:07,AA,9 01:02,BB,2 01:03,BB,3 01:04,BB,3 01:05,BB,4 01:07,BB,9 01:08,BB,5 02:02,CC,2 02:03,CC,3 02:04,CC,3 02:05,CC,4 02:06,CC,5 02:07,CC,9 03:01,DD,1 04:02,EE,2 04:03,EE,4 04:04,EE,3 04:05,EE,9" | table timelogged, formDataId, eventOrder ...how could the highlighted transactions be identified? Note: We do not get all types of events and the 'first' event is not usually seen [as indicates an error on vendor side] ... View more

Hi All, Hopefully someone can help with this.   We have logs that contain JSON where one of the fields can have multiple groups/entries - I would like to unwind/expand the groups to have a separate output per line.  I think I have to use mvzip command but I'm having issues with syntax.  Example data/query below... | makeresults format=json Data="[ { \"event\": \"AGREEMENT_ACTION_COMPLETED\", \"participantUserEmail\": \"123456789@test.com\", \"agreement\": { \"id\": \"ABCDEFGHIJKLMNOPQRSTUVWXYZ\", \"status\": \"OUT_FOR_SIGNATURE\", \"participantSetsInfo\": { \"participantSets\": [ { \"memberInfos\": [ { \"id\": \"abcdefg\", \"email\": \"abcdefg@test.com\", \"company\": null, \"name\": \"test o'test\", \"privateMessage\": null, \"status\": \"ACTIVE\" } ], \"order\": \"1\", \"role\": \"SIGNER\", \"status\": \"WAITING_FOR_OTHERS\", \"id\": \"abcdefg1234\", \"name\": null, \"privateMessage\": null }, { \"memberInfos\": [ { \"id\": \"hijklmno\", \"email\": \"hijklmno@test.com\", \"company\": null, \"name\": null, \"privateMessage\": null, \"status\": \"ACTIVE\" } ], \"order\": \"1\", \"role\": \"SIGNER\", \"status\": \"WAITING_FOR_MY_SIGNATURE\", \"id\": \"hijklmno1234\", \"name\": null, \"privateMessage\": null } ] }, \"documentsInfo\": null, \"agreementViewRequest\": null } }]" | spath output=eventType path=event | spath output=agreementId path=agreement.id | spath output=agreementStatus path=agreement.status | spath output=participantUserEmail path=participantUserEmail | rename participantSets{}.membersInfos{}.email as memberEmail, participantSets{}.status as memberStatus | table _time, agreementId, eventType, agreementStatus, participantUserEmail, memberEmail, memberStatus I still see only one line output and the 'memberEmail' and 'memberStatus' fields are showing as blank where as I want to see one line out to match every entry under 'participantSets' field. Any help appreciated. ... View more

I have a query … index=blah "BAD_REQUEST" | rex "(?i) requestId (?P<requestId>[^:]+)" | table requestId | dedup requestId …that returns 7 records/fields… 92d246dd-7aac-41f7-a398-27586062e4fa ba79c6f5-5452-4211-9b89-59d577adbc50 711b9bb4-b9f1-4a2b-ba56-f2b3a9cdf87c e227202a-0b0a-4cdf-9b11-3080b0ce280f 6099d5a3-61fc-418b-87b4-ddc57c482dd6 348fb576-0c36-4de9-a55a-97157b00a304 c34b7b96-094d-45bb-b03d-f9c98a4efd5f …that I then want to use as input for another search on the same index I looked at manual and can see that subsearches are allowed [About subsearches - Splunk Documentation] but when I add my subsearch as input … index=blah [search index=blah "BAD_REQUEST" | rex "(?i) requestId (?P<requestId>[^:]+)" | table requestId | dedup requestId] ..I would have expected at least 7 records to have been returned BUT I do not see any output. There are no syntax issues so can someone explain to me what I’m not seeing/doing? Any help appreciated. ... View more

Hi All We have a couple of jobs that occasionally loop around same code returning same message/log - is it possible for a search string to pick up instances where the last [say] 3 logs are identical? Kinds regards Mick   ... View more