About onthakur

onthakur

Log1 (dataset1) Splunk Query :- index=xyz X_App_ID=abc API_NAME=abc_123 NOT externalURL Output of splunk Query :- 2025-05-01 04:54:57.335 : X-Correlation-ID=1234-acbd : X-App-ID=abc : X-Client-ID=kjzoAHK7Bt2vnV5jLQIUuKQZDaXqtJJK : X-Client-Version=6.0.0.3627 : X-Workflow= : serviceType= : API_NAME=abc_123 : COMPLETE_URL=<URL> : Client_IP=<IP>: ApiName=abc_123 : StatusCode=200 : ExecutionTime=234 : Brand=abc_345 : Response={JASON response} Log2 (dataset2) Spluk Query :- index=xyz "xmlResponseMapping" Output of splunk Query :- 2025-05-01 04:54:57.335 : X-Correlation-ID=1234-acbd : xmlResponseMapping : accountType=null, accountSubType=null, Dataset1 and Dataset2 are connected using "X-Correlation-ID" only and dataset2 has more than 3000K logs for last 8 hrs,while dataset1 has 20-21K logs for last 8hrs I want "accountType" and "accountSubType" from dataset2 for X-Correlation-ID=<alpha-numeric> where X-App-ID=abc from dataset1. Dataset2 is having data for multiple "X-App-ID" but doesnt have field "X-App-ID" in logs. If I try below query then it is giving me output of 3000K (all from dataset2) index=masapi (X_App_ID=ScamShield API_NAME=COMBINED_FEATURES NOT externalURL) OR (napResponseMapping) |stats values(accountType) as accountType values(accountSubType) as accountSubType by X_Correlation_ID Kindly suggest the better way.

onthakur

Hello Friends, I am trying to join the 2 logs with same index using trx_id(here it is called X_Correlation_ID ) but subquery is returning more than 3000K rows hence it is not working. can someone please help me with another way to join two logs without using "join" command. index=xyz X_App_ID=abc API_NAME=abc_123 NOT externalURL |rename X_Correlation_ID AS ID |table ID |join ID [search index=xyz "xmlResponseMapping" |rename X_Correlation_ID AS ID |table accountType,accountSubType,ID] |table ID,accountType,accountSubType

onthakur · ‎01-29-2025

Team, I got stats output as below and I need to compare the field value under column "source" with its count. Ex :- If count of source ABC is 0 and count of source XYZ is 1 then it should print "Missing in Source ABC". If both are 0 then it should print "Missing in both Source ABC and XYZ". stats current output :- transaction_id source count 12345 ABC 0 12345 XYZ 1 Required table output:- transaction_id Status 12345 Missing in source ABC

onthakur · ‎01-28-2025

This resolution worked with minor changes . Many thanks for your help | chart count OVER transaction_id BY source

onthakur · ‎01-28-2025

Team, I got stats output as below and I need to rearrange stats current output :- transaction_id source count 12345 ABC 1 12345 XYZ 1 Required Output :- transaction_id ABC XYZ 12345 1 1

onthakur · ‎01-27-2025

Team, I have a situation where user is calling service 1 and then service1 calls service2 using same transaction_id sometime it happens that user is calling service 1 but it is not calling service2 and vise versa. I need a query which will show result in table format and show yes/No if service 1/2 called or not. transaction_id , service1_status , service2_status. 1234 , yes ,yes 5678, yes, No Ex :- log of service 1 :- <timestamp> <transaction_id> <service1 URL> log of service 2 :- <timestamp> <transaction_id> <service2 URL>

onthakur · ‎05-30-2024

What is the relationship between ID and Event, because you don't appear to be doing anything with ID in you current search. Does Event exist in your second dataset (ERROR API [ID]) #### ID is the command field in both the data sets . while Event is only present in 1st data set i.e ("API : access : * : process : Payload:")

onthakur · ‎05-29-2024

index=abcd "API : access : * : process : Payload:" |rex "\[INFO \] \[.+\] \[(?<ID>.+)\] \:" |rex " access : (?<Event>.+) : process" |stats count as Total by Event |join type=inner ID [|search index=abcd "API" AND ("Couldn't save") |rex "\[ERROR\] \[API\] \[(?<ID>.+)\] \:" |dedup ID |stats count as Failed ] |eval Success=Total-Failed |stats values(Total),values(Success),values(Failed) by Event Event values(Total) values(Success) values(Failed) Event1 76303 76280 23 Event2 4491 4468 23 Event3 27140 27117 23 Event4 118305 118282 23 Event5 318810 318787 23 Event6 9501 9478 23 I am trying to join to different search (index is common) on ID field and then trying to group them by "Event" field but the Failed column is showing the same value for all the events.

onthakur · ‎05-29-2024

Team, I got 3 logs, I need to fetch Transaction_id,Event and Total_Count from LOG1. After that I need to join the 3 logs to get Successfull and Failures. successfull transaction will have only LOG2. Failure transactions will have both LOG2 and LOG3 Finally I need data in timechart (span=1h). _time Event Total_Count Successfull Error LOG1 = 024-05-29 12:35:49.288 [INFO ] [Transaction_id] : servicename : access : Event : process : Payload: LOG2 = 2024-05-29 12:11:09.226 [INFO ] [Transaction_id] : application_name : report : servicename (Async) : DB save for SubscribersSettingsAudit record completed in responseTime=2 ms LOG3 = 2024-05-24 11:25:36.307 [ERROR] [Transaction_id] : application_name : regular : servicename (Async) : Couldn't save the SubscribersSettings record in DB

onthakur · ‎01-19-2024

Json :- | makeresults | eval _raw="{ \"a.com\": [ { \"yahoo.com\":\"10ms\",\"trans-id\": \"x1\"}, { \"google.com\":\"20ms\",\"trans-id\": \"x2\"} ], \"trans-id\":\"m1\", \"duration\":\"33ms\" }" need output in below format:- _time Trans_id url Duration sub_duration sub_url sub_trans_id m1 a.com 33ms 10ms yahoo.com x1 m1 a.com 33ms 20ms google.com x2

onthakur · ‎01-18-2024

Thanks you very much , your solution worked perfectly.

onthakur · ‎01-18-2024

I have below json and I want table of url and corresponding duration. { "details": { "sub-trans": [ { "app-trans-id": "123", "sub-trans-id": "234", "startTime": "2024-01-18T12:37:12.482Z", "endTime": "2024-01-18T12:37:12.502Z", "duration": 20, "req": { "url": "http://abc123", }, { "app-trans-id": "123", "sub-trans-id": "567", "startTime": "2024-01-18T12:37:12.506Z", "endTime": "2024-01-18T12:37:12.550Z", "duration": 44, "req": { "url": "https://xyz567", }, ] } } I am using below splunk query but duration field is not populating in table. Kindly help index=hello |spath output=url details.sub-trans{}.req.url| mvexpand url |spath output=duration details.sub-trans{}.duration |mvexpand duration |table url,duration

onthakur · ‎01-18-2024

I got 2 fields from same splunk index field1 have rows 1,2,3,4,5 and field2 have rows 10,12 I want new field3 with data from both field1 and field2. Please suggest. field1 field2 1 10 2 12 3 4 5 field3 1 2 3 4 5 10 12

onthakur · ‎04-11-2023

Friends, I have extracted the field "ussdcode" from xml using "xmlkv" and renamed it to "UssdCode" . Now I want to pass value to "UssdCode" using dropdown list. I have also created "UssdCode_Token" in dropdown and have provided static value "ALL =* " in dropdown. can someone plz help me with filtering the data using dropdown? index=masapi sourcetype = myaccountservices-api_reporting_log ussdcode AND StatusCode=$StatusCode_token$ |eval temp=split(_raw,":") |eval trx_id=mvindex(temp,3) |dedup trx_id |xmlkv |rename ussdcode as UssdCode |stats Count by UssdCode,StatusCode | addcoltotals Count labelfield="StatusCode"

onthakur · ‎06-01-2022

Team, I have below timechart which is counting http error/success codes for a span of 1hr. Now I need to calculate the percentage increase (or decrease) in each error/success code based on previous hour. _time 200 4xx errors 5xx errors 2022-05-23 00:00 100 20 30 2022-05-23 01:00 200 30 30 2022-05-23 02:00 250 50 60 2022-05-23 03:00 300 30 50 2022-05-23 04:00 350 40 40 2022-05-23 05:00 400 60 60 2022-05-23 06:00 500 80 80

onthakur · ‎05-27-2022

Hello, I am looking for the timechart option where I can get data for last 7 days for a particular time range. Ex :- if I select time range as 01:00:00 to 02:00:00 AM then should show data for last 7 days for the same time range. Date/Time range Count 2022-05-27 01:00:00 02:00:00 A 2022-05-26 01:00:00 02:00:00 B 2022-05-25 01:00:00 02:00:00 C 2022-05-24 01:00:00 02:00:00 D 2022-05-23 01:00:00 02:00:00 E 2022-05-22 01:00:00 02:00:00 F 2022-05-21 01:00:00 02:00:00 G Thanks

onthakur · ‎05-18-2022

thank you that works.

onthakur · ‎05-17-2022

below is the data which has multiple features for a single item. I want to write a regex which could search all occurrences of feature (not just first occurance) and then count the feature . I have written below search string but count value is not consistent. can someone plz take a look and advice. Many thanks in advance. |makeresults | eval _raw="[{\"\"feature\"\": \"\"INTDATA\"\"}, {\"\"feature\"\": \"\"INTDATA2\"\"}, {\"\"feature\"\": \"\"MGDAT0\"\"}, {\"\"feature\"\": \"\"MGPR2TI\"\"}, {\"\"feature\"\": \"\"MSTORE\"\"}, {\"\"feature\"\": \"\"PNINCLWAP\"\"}, {\"\"feature\"\": \"\"PRMCAFIND\"\"}, {\"\"feature\"\": \"\"3WY\"\"}, {\"\"feature\"\": \"\"CFC\"\"}, {\"\"feature\"\": \"\"CFU\"\"}, {\"\"feature\"\": \"\"CLIP\"\"}, {\"\"feature\"\": \"\"CLIR\"\"}, {\"\"feature\"\": \"\"CLW\"\"}, {\"\"feature\"\": \"\"DATA\"\"}, {\"\"feature\"\": \"\"CAMTAC\"\"}, {\"\"feature\"\": \"\"HOLD\"\"}, {\"\"feature\"\": \"\"INROAM\"\"}, {\"\"feature\"\": \"\"ISP\"\"}, {\"\"feature\"\": \"\"MSTORE\"\"}, {\"\"feature\"\": \"\"NWROAM\"\"}, {\"\"feature\"\": \"\"PERMGL\"\"}, {\"\"feature\"\": \"\"SMSO\"\"}, {\"\"feature\"\": \"\"VM\"\"}, {\"\"feature\"\": \"\"GFLEX\"\"}]" |rex max_match=0 "\"\"feature\"\": \"\"(?<feature>.*?)\"\"}" |stats count(feature) by feature

onthakur · ‎11-22-2021

Hi I have logs in below format, which is mix of delimiter (|) and json. now I want to extract statuscode and statuscodevalue and create table with columns _time,statuscodevalue,statuscode. can someone please help me ? 2021-11-22 05:52:09.755 INFO - c.t.c.a.t.service.UserInfoService(101) - abcd | abcd-APP | /user-info | af4772c0-1fcd-4a82-858e-c2f7f0821724 | APP | -| Response of validateAddress abcd Service: { "headers" : { }, "body" : { "baseError" : { "code" : "3033", "reason" : "User is unauthorized", "explanation" : "Unauthorized" } }, "statusCode" : "UNAUTHORIZED", "statusCodeValue" : 401 }

Posts	19
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎11-22-2021

Online Status	Offline
Date Last Visited	3 weeks ago

How to join 2 logs using trx_id

Compare the field value with its count.

Rearrange the stats output.

Search same transaction_id in 2 different services...

Join with Stats

Multiple joins based of conditions.

Json Parsing..

Json Parsing.

Create new field by combining 2 fields from same i...

How to pass value to extracted field using dropdow...

Re: How to join 2 logs using trx_id

How to join 2 logs using trx_id

Compare the field value with its count.

Re: Rearrange the stats output.

Rearrange the stats output.

Search same transaction_id in 2 different services...

Re: Join with Stats

Join with Stats

Multiple joins based of conditions.

Json Parsing..

Re: Json Parsing.

Json Parsing.

Create new field by combining 2 fields from same i...

How to pass value to extracted field using dropdow...

How to calculate the percentage increase (or decre...

Splunk Timechart- How get data for last 7 days for...

Re: How to write a Regex to search globally?

How to write a Regex to search globally?

json parsing

Are you a member of the Splunk Community?