Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About he204035
he204035
Explorer
Member since:
01-27-2022
03-12-2024
Community Statistics
| Posts | 9 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 01-27-2022 |
Activity Feed
- Posted Calculate Difference Between Same Field in Different Rows on Reporting. 03-12-2024 11:05 AM
- Posted Re: rex on rex101 works fine...Splunk returns a blank on Splunk Search. 02-02-2022 07:33 AM
- Posted Re: rex on rex101 works fine...Splunk returns a blank on Splunk Search. 02-02-2022 07:19 AM
- Posted Re: rex on rex101 works fine...Splunk returns a blank on Splunk Search. 02-02-2022 06:10 AM
- Posted Re: rex on rex101 works fine...Splunk returns a blank on Splunk Search. 02-01-2022 03:39 PM
- Posted Re: rex on rex101 works fine...Splunk returns a blank on Splunk Search. 02-01-2022 03:29 PM
- Posted rex on rex101 works fine...Splunk returns a blank on Splunk Search. 02-01-2022 03:13 PM
- Posted Re: rex for http2 field in log on Splunk Search. 01-28-2022 05:52 AM
- Karma Re: rex for http2 field in log for johnhuang. 01-28-2022 05:52 AM
- Karma Re: rex for http2 field in log for yuanliu. 01-28-2022 05:52 AM
- Posted rex for http2 field in log on Splunk Search. 01-27-2022 02:15 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
03-12-2024
11:05 AM
If I have the following table using columns DATE and USAGE, is there a way to create a 3rd column to display the difference in the USAGE column from Day X to previous day? DATE USAGE Feb-28 Feb-29 Mar-01 Mar-02 Mar-03 Mar-04 Mar-05 Mar-06 Mar-07 Mar-08 Mar-09 Mar-10 Mar-11 Mar-12 17.68 gb 18.53 gb 19.66 gb 21.09 gb 22.04 gb 23.21 gb 24.20 gb 24.94 gb 25.64 gb 26.80 gb 27.79 gb 29.07 gb 30.09 gb 31.01 gb
... View more
Labels
- Labels:
-
data model
02-02-2022
07:33 AM
When I paste into Notepad, it just prints as one long line, nothing weird showing up. Maybe I need to try to do a split instead. It's just that the "Http2_status" doesn't always show up in the same place in the log outputs.
... View more
02-02-2022
07:19 AM
Error2 just shows up blank.
... View more
02-02-2022
06:10 AM
Using Splunk Enterprise 8.1.5
... View more
02-01-2022
03:39 PM
Splunk Enterprise version 8.1.5
... View more
02-01-2022
03:29 PM
Splunk Enterprise Version:8.1.5
... View more
02-01-2022
03:13 PM
I have a rex built that when plugged into rex101 works fine, but when applied via a Splunk query, returns a blank result. Text: 2022/02/01 23:07:26.979 [ERROR] [nrfClient.Discovery.nrf] Message send failed, response [Type:ABC Http2_Status:404 CauseCode:"CONTEXT_NOT_FOUND" RetryExhausted:true MsgType:1434 ServiceName:nabc SelectedProfileName:"abc-profile" FailureProfile:"FHABC" GroupID:"ABC-*" ] rex: Http2_Status:\d{3}\sCauseCode:\"(?<Error2>\w+)\"\s rex101 result: CONTEXT_NOT_FOUND But when plugged into Splunk, it comes back with a blank result.
... View more
Labels
- Labels:
-
rex
01-27-2022
02:15 PM
In the following log entry as "_raw": "OPTIONS /nnrf-nfm/v1 HTTP/2.0" 405 173 "-" "gmlc-http-client/2.0" "-" I have successful rex for the "405" error field location and "173" error field location. I would like to build a rex to identify the "gmlc-http-client" section of that log entry. (That field can show several different client types between those quotes.) My rex is as follows: rex field=_raw "HTTP\/2\.0\"\s\d{3}\s\d{3}\s\"\-\"\s\"(?<Error3>)\"\s\"\-\"" This rex does not error, but the result comes back as null/blank.
... View more
Labels
- Labels:
-
rex
