Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About ssamant007
ssamant007
Explorer
Member since:
09-08-2021
01-17-2022
Community Statistics
| Posts | 11 |
| Solutions | 0 |
| Karma Given | 4 |
| Karma Received | 0 |
| Member Since | 09-08-2021 |
Activity Feed
- Posted Re: specific field extraction from _raw event data/message on Splunk Search. 12-02-2021 08:16 PM
- Karma Re: specific field extraction from _raw event data/message for Gr0und_Z3r0. 12-02-2021 08:15 PM
- Posted specific field extraction from _raw event data/message on Splunk Search. 12-02-2021 12:47 AM
- Posted Re: Event line breaker to index multi-line events into single event on Getting Data In. 12-02-2021 12:27 AM
- Posted Re: Event line breaker to index multi-line events into single event on Getting Data In. 12-01-2021 02:43 PM
- Posted Re: Event line breaker to index multi-line events into single event on Getting Data In. 11-30-2021 02:53 PM
- Posted Event line breaker to index multi-line events into single event on Getting Data In. 11-30-2021 02:35 PM
- Posted Re: A dropdown menu within a panel and change in the search query based on input selection on Splunk Dev. 10-13-2021 05:25 AM
- Karma Re: A dropdown menu within a panel and change in the search query based on input selection for ITWhisperer. 10-13-2021 05:23 AM
- Karma Re: A dropdown menu within a panel and change in the search query based on input selection for RickvdIJ. 10-13-2021 05:23 AM
- Posted A dropdown menu within a panel and change in the search query based on input selection on Splunk Dev. 10-12-2021 04:32 PM
- Tagged A dropdown menu within a panel and change in the search query based on input selection on Splunk Dev. 10-12-2021 04:32 PM
- Tagged A dropdown menu within a panel and change in the search query based on input selection on Splunk Dev. 10-12-2021 04:32 PM
- Tagged A dropdown menu within a panel and change in the search query based on input selection on Splunk Dev. 10-12-2021 04:32 PM
- Posted Re: Searching result using two inputlookup collections on Splunk Search. 09-08-2021 02:13 AM
- Karma Re: Searching result using two inputlookup collections for ITWhisperer. 09-08-2021 01:59 AM
- Posted Re: Searching result using two inputlookup collections on Splunk Search. 09-08-2021 01:53 AM
- Posted Searching result using two inputlookup collections on Splunk Search. 09-08-2021 01:30 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-02-2021
08:16 PM
Thanks @Gr0und_Z3r0 . this is what I was looking for.
... View more
12-02-2021
12:47 AM
I have event data from the search result in format as shown in the image, now I want to extract the following fields with their corresponding values excluding the remaining fields or data from the event data/string: id = b0ad6627-a6e1-4f5e-92f4-9c2deaa1ff2a_1cd4b06f83caac09 start_date_time = 1638433382 (value always required) end_date_time = null or 1638433491 (if value not present) current = <value> (only if the field exist) (6 in the example) total = <value> (6 in the example) status_type = COMPLETED bot_uri = repository:///Automation%20Anywhere/Bots/Test%20A2019/AALogTestBot I tried using <search query> | rex field=_raw "(?msi)(?<ev_field>\{.+\}$)" | spath input=ev_field to extract all the fields in the Event data, but did not change the search results. Any suggestion or help highly appreciated I am newbie to Splunk... TIA 12/2/21 7:24:52.106 PM 2021-Dec-02 Thu 19:24:52.106 INFO [pool-12-thread-1] - com.automationanywhere.nodemanager.service.impl.NodeMessagingServiceImpl - {} - writeSuccess(NodeMessagingServiceImpl.java:395) - Message eventData { id: "b0ad6627-a6e1-4f5e-92f4-9c2deaa1ff2a_1cd4b06f83caac09" bot_execution { start_date_time { seconds: 1638433382 nanos: 210329300 } end_date_time { seconds: 1638433491 nanos: 993822800 } progress { current: 6 total: 6 percentage: 100 } status_type: COMPLETED bot_uri: "repository:///Automation%20Anywhere/Bots/Test%20A2019/AALogTestBot?fileId=1098948&workspace=PRIVATE" }} sent to CR successfully.
... View more
Labels
- Labels:
-
eval
-
field extraction
-
fields
-
rex
-
subsearch
12-02-2021
12:27 AM
apparently, it worked after selecting the sourcetype as CSV.
... View more
12-01-2021
02:43 PM
Hi yes, I have gone through the documentation as well, and I have configured the props.conf file inside the $splunk_home$\etc\system\local\ as follows: [mysource-type] LINE_BREAKER = ([\r\n]+) SHOULD_LINEMERGE = false DATETIME_CONFIG = CURRENT ..and the default values of props.conf file in the ..\system\default\ folder are as follows: [default] CHARSET = AUTO LINE_BREAKER_LOOKBEHIND = 100 TRUNCATE = 10000 LB_CHUNK_BREAKER_TRUNCATE = 2000000 DATETIME_CONFIG = \etc\datetime.xml ADD_EXTRA_TIME_FIELDS = True ANNOTATE_PUNCT = True HEADER_MODE = MATCH_LIMIT = 100000 DEPTH_LIMIT = 1000 MAX_DAYS_HENCE=2 MAX_DAYS_AGO=2000 MAX_DIFF_SECS_AGO=3600 MAX_DIFF_SECS_HENCE=604800 MAX_TIMESTAMP_LOOKAHEAD = 128 DETERMINE_TIMESTAMP_DATE_WITH_SYSTEM_TIME = false SHOULD_LINEMERGE = True BREAK_ONLY_BEFORE = BREAK_ONLY_BEFORE_DATE = True MAX_EVENTS = 256 MUST_BREAK_AFTER = MUST_NOT_BREAK_AFTER = MUST_NOT_BREAK_BEFORE = TRANSFORMS = SEGMENTATION = indexing SEGMENTATION-all = full SEGMENTATION-inner = inner SEGMENTATION-outer = outer SEGMENTATION-raw = none SEGMENTATION-standard = standard LEARN_SOURCETYPE = true LEARN_MODEL = true termFrequencyWeightedDist = false maxDist = 100 AUTO_KV_JSON = true detect_trailing_nulls = auto sourcetype = priority = Do you think I missed on the some other configurations?? I double check that in the source log file each line are separated with CRLF charatcter...
... View more
11-30-2021
02:53 PM
Yes, technically it should work but upon checking the end of line character in the log file it shows CRLF character for each line. You can see in the image that EOL character in log file entries has \r\n for each line.
... View more
11-30-2021
02:35 PM
My current log monitoring splunk forwarder is indexing events in group (like sometimes more than 1 events together) but I wanted to have each event (which is own datetime at the start) to be indexed separately. Only the starting of event is same for each line (event) and rest of the string varies. I tried configuring the props.conf file using the following formats: LINE_BREAKER = ([\r\n]+) (though its by default but seems not working as my events are separated by newline or \r in the source log file) and then I tried as below: BREAK_ONLY_BEFORE = ^\d+\s*$ Currently it is being indexed as shown below: However, I wanted to have each entry indexed as a separate event. Entries in source file (example) 2021-Dec-01 Wed 08:50:06.914 INFO [Thread-3] - org.eclipse.jetty.server.session - {} - doStart(DefaultSessionIdManager.java:334) - DefaultSessionIdManager workerName=node0 2021-Dec-01 Wed 08:50:06.915 INFO [Thread-3] - org.eclipse.jetty.server.session - {} - doStart(DefaultSessionIdManager.java:339) - No SessionScavenger set, using defaults 2021-Dec-01 Wed 08:50:06.917 INFO [Thread-3] - org.eclipse.jetty.server.session - {} - startScavenging(HouseKeeper.java:132) - node0 Scavenging every 660000ms 2021-Dec-01 Wed 08:50:06.956 INFO [Thread-3] - org.eclipse.jetty.server.AbstractConnector - {} - doStart(AbstractConnector.java:331) - Started ServerConnector@5e283ab9{HTTP/1.1, (http/1.1)}{127.0.0.1:22113} 2021-Dec-01 Wed 08:50:06.956 INFO [Thread-3] - org.eclipse.jetty.server.Server - {} - doStart(Server.java:415) - Started @6850ms 2021-Dec-01 Wed 08:50:24.331 INFO [pool-6-thread-1] - com.automationanywhere.nodemanager.service.impl.WindowsEventServiceImpl - {} - onMachineLogon(WindowsEventServiceImpl.java:226) - Machine Logon: 1 2021-Dec-01 Wed 08:58:35.372 INFO [pool-6-thread-1] - com.automationanywhere.nodemanager.service.impl.WindowsEventServiceImpl - {} - onMachineLocked(WindowsEventServiceImpl.java:204) - Machine Locked: 1 2021-Dec-01 Wed 09:17:38.934 INFO [pool-6-thread-1] - com.automationanywhere.nodemanager.service.impl.WindowsEventServiceImpl - {} - onMachineUnlocked(WindowsEventServiceImpl.java:214) - Machine Unlocked: 1 2021-Dec-01 Wed 09:17:38.937 INFO [pool-6-thread-1] - com.automationanywhere.nodemanager.service.impl.WindowsEventServiceImpl - {} - onMachineUnlocked(WindowsEventServiceImpl.java:216) - Session id 1 removed from tracking on machine unlock. I would appreciate any help in configuring the props.conf file to index events as a single entry. TIA.
... View more
Labels
10-13-2021
05:25 AM
Thanks @ITWhisperer & @RickvdlJ . I built the solution based on the idea suggested.
... View more
10-12-2021
04:32 PM
I want to add a dropdown selection menu inside a dashboard panel using html and then based on the selected item from the dropdown , need to change the search query accordingly and results are updated in the chart visualization. Example: Select Month: All, Jan, Feb, ...Dec. Now when user selects all, the query will display results for entire year (jan -dec) and when jan is selected then chart is displayed only showing the entire january data. Similarly for others. I have other different panels within the dashboard under differet rows, and I need to insert the drop down menu only for a specific panel. Also, my base search remains same irrespective of the drop-down selection, only the panel search string changes with change in the dropdown selection. - any suggestion or guide would be a great help. It would be nice if it can be done with no or minimal use of JavaScript. TIA thanks
... View more
Labels
- Labels:
-
visualization
09-08-2021
02:13 AM
Thanks @ITWhisperer .
... View more
09-08-2021
01:53 AM
What if I need to match with only subset of fieldX values from collectionB into the field1 values from collectionA assuming the collectionB has other fields . Like collectionB: fieldX, fieldY Y ss A zz B yy i.e. first I need to extract results from collectionB based on column 'fieldY' say fieldY='zz' | inputlookup collectionA | search [| inputlookup collectionB | search fieldY ='zz' | fields fieldX | rename..... but it didnt serve my required results. It is returning all the rows from collection A.
... View more
09-08-2021
01:30 AM
I need to find the rows from the first inputlookup collection that has matching field values from the second inputlookup collection. For example: collection A : field1, field2, field3 X 1 3 X 2 4 Y 4 1 Z 1 2 B 3 3 B 1 1 CollectionB: fieldX X Y B The expected result is: (exclude row containing 'Z' as it does not entry in collectionB) field1, field2, field3 X 1 3 X 2 4 Y 4 1 B 1 1 the query like: | inputlookup collectionA | search field1 IN ('X','Y','Z'....). How can I set values 'X','Y','Z'.... to search for field1 from collectionB as this list can be of any length. I tried the following but didn't work: | inputlookup collectionA | search field1 IN (| inputlookup collectionB |fields fieldX). (as in reality the collectionB can have more than one columns but I want to match values only with fieldX)
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-17-2022
09:03 PM
|
