Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About nateNpgh
nateNpgh
Loves-to-Learn Lots
Member since:
12-09-2021
06-30-2023
Community Statistics
| Posts | 9 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 12-09-2021 |
Activity Feed
- Posted Re: Extracting data which is incosistent on Splunk Search. 06-30-2023 06:38 AM
- Posted Extracting data which is incosistent on Splunk Search. 06-30-2023 06:15 AM
- Posted Re: How to Optimize Splunk Search to avoid "auto-finalized after disk usage limit of 100MB" on Splunk Search. 12-10-2021 12:59 PM
- Posted Re: How to Optimize Splunk Search to avoid "auto-finalized after disk usage limit of 100MB" on Splunk Search. 12-10-2021 12:58 PM
- Posted Re: How to Optimize Splunk Search to avoid "auto-finalized after disk usage limit of 100MB" on Splunk Search. 12-10-2021 12:10 PM
- Posted Re: How to Optimize Splunk Search to avoid "auto-finalized after disk usage limit of 100MB" on Splunk Search. 12-10-2021 10:08 AM
- Posted Re: How to Optimize Splunk Search to avoid "auto-finalized after disk usage limit of 100MB" on Splunk Search. 12-10-2021 08:25 AM
- Posted Re: How to Optimize Splunk Search to avoid "auto-finalized after disk usage limit of 100MB" on Splunk Search. 12-10-2021 07:55 AM
- Posted How to Optimize Splunk Search to avoid "auto-finalized after disk usage limit of 100MB" on Splunk Search. 12-09-2021 07:08 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
06-30-2023
06:15 AM
I need to extract a time value from log file where the time value appears with a few different variations of characters around it. I'm struggling with handling all the variations through my regex extract. Below are examples of each of the variations: ChainedQuery elapsed time [90]ms Elapsed time: 114ms Elapsed time to get Service pool: 339 Elapsed Time: 69 ,took 37ms Is there a way to extract all the numeric values with 1 regex?
... View more
Labels
- Labels:
-
field extraction
-
regex
12-10-2021
12:59 PM
The search will completely run over a smaller time window, but was hoping to be able to run it for a 24 hr period.
... View more
12-10-2021
12:58 PM
we are running Version:7.3.7.1 So that likely explains it.
... View more
12-10-2021
12:10 PM
I created an extract field, but they are also in there like that...
... View more
12-10-2021
08:25 AM
Thanks for the suggestion! I tried this, and it ran very fast without errors, but the results returned 0 statistics. I know there are definitely TxId's that have move than 100 events during the search timeframe.
... View more
12-10-2021
07:55 AM
Thanks for the suggestions, unfortunately I still hit the limit with this approach.
... View more
12-09-2021
07:08 AM
When running the following search for a 24hr period it is always being auto-finalized due to disk usage limit of 100MB. index="app_ABC123" source="/var/abc/appgroup123/logs/app123/stat.log" | stats count as TotalEvents by TxId | sort TotalEvents desc | where TotalEvents > 100 Is there any way for me to optimize the search so that it doesn't hit the limit?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-30-2023
04:01 PM
|
