Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About kc_prane
kc_prane
Path Finder
Member since:
02-12-2022
Saturday
Community Statistics
| Posts | 23 |
| Solutions | 1 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 02-12-2022 |
Activity Feed
- Posted Re: Need REX Help - Table results on Splunk Search. Friday
- Posted Re: Need REX Help - Table results on Splunk Search. Friday
- Posted Re: Need REX Help - Table results on Splunk Search. Wednesday
- Posted Need REX Help - How do I table results? on Splunk Search. Wednesday
- Tagged Need REX Help - How do I table results? on Splunk Search. Wednesday
- Posted Re: Regex Help Need on Splunk Enterprise. Wednesday
- Posted How to build rex for field extraction in one event? on Splunk Enterprise. Tuesday
- Tagged How to build rex for field extraction in one event? on Splunk Enterprise. Tuesday
- Posted Re: Splunk Regex Help on Splunk Search. 06-21-2022 02:33 PM
- Posted Re: Splunk Regex Help on Splunk Search. 06-21-2022 02:32 PM
- Posted Re: Splunk Regex Help on Splunk Search. 06-21-2022 08:36 AM
- Karma Re: Splunk Regex Help for gcusello. 06-21-2022 08:30 AM
- Posted Re: Splunk Regex Help on Splunk Search. 06-21-2022 07:51 AM
- Posted Help with Splunk Regex on Splunk Search. 06-20-2022 04:33 PM
- Tagged Help with Splunk Regex on Splunk Search. 06-20-2022 04:33 PM
- Posted Re: Need Help with Splunk Query on Splunk Search. 04-20-2022 08:24 PM
- Posted Need Help with Splunk Query- Titles in chart on Splunk Search. 04-20-2022 08:20 PM
- Posted Re: REX Field Help on Splunk Search. 03-11-2022 12:21 PM
- Posted Re: REX Field Help on Splunk Search. 03-11-2022 12:04 PM
- Posted Re: REX Field Help on Splunk Search. 03-11-2022 10:34 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
Friday
Hi yuanliu - Thanks for the response. Can you please provide the exact query. you results looks good
... View more
Friday
Hi gcusello - Yes all the lines are for the same event how do i seperate them they about 60 lines. this is an .csv file.
... View more
Wednesday
Hi Gcusello - thaks for the response. Please find the belwo log. Detail_Message , COUNT TEST_DETAIL_MESSAGE =Person with given Individual Id doesn ' t exist , TEST_COUNT = 28340 TEST_DETAIL_MESSAGE =could not extract ResultSet ; SQL [ n/a ]; nested exception is org.hibernate.exception.SQLGrammarException: could not extract ResultSet , TEST_COUNT = 301 TEST_DETAIL_MESSAGE =No entity found for query , TEST_COUNT = 59 TEST_DETAIL_MESSAGE =Search Query Processing error org.springframework.orm.jpa.JpaSystemException: Found shared references to a collection: com.ltss.common.transition.model.TnsRqst.tnsAddrDtls ; nested exception is org.hibernate.HibernateException: Found shared references to a collection: com.ltss.common.transition.model.TnsRqst.tnsAddrDtls , TEST_COUNT = 60 TEST_DETAIL_MESSAGE =Found shared references to a collection: com.ltss.common.transition.model.TnsRqst.tnsAddrDtls ; nested exception is org.hibernate.HibernateException: Found shared references to a collection: com.ltss.common.transition.model.TnsRqst.tnsAddrDtls , TEST_COUNT = 501
... View more
Wednesday
Hello, when i table the results the results are not matching exact with the next columns. what can i add to reslove this issue. Please find the below screenshot for the results.
|rex field=_raw "(TEST_DETAIL_MESSAGE\s\=)(?<MESSAGE>\w+\D+\,)" max_match=0 |rex field=_raw "(TEST_COUNT\s\=)(?<COUNT>\s\d+)" max_match=0 | table MESSAGE COUNT
... View more
- Tags:
- rex
Labels
- Labels:
-
rex
Tuesday
Hello, Can someone Please help to build rex for field extraction in one event. Currently iam using the below basic rex but its pulling only first line in the results. i need all the results so i can table them.
|rex field=_raw "(TEST_DETAIL_MESSAGE\s\=)(?<MESSAGE>\w+\D+\,)" |rex field=_raw "(TEST_COUNT\s\=)(?<COUNT>\s\d+)"
... View more
- Tags:
- regex
Labels
- Labels:
-
development
06-21-2022
02:33 PM
Hi @gcucello - No worries I got the solution, thanks a lot | rex "START.*messageDetails\>\d+\-\d+\-\d+\s+(?<Start_Time>\d+\:\d+\:\d+)" | rex "END.*messageDetails\>\d+\-\d+\-\d+\s+(?<End_Time>\d+\:\d+\:\d+)" | eval ST = Strptime(Start_Time, "%H:%M:%S.%3N") | eval ET = Strptime(End_Time, "%H:%M:%S.%3N") | eval ResponseTime = tostring((ET -ST), "duration") | table _time host tag::host Start_Time End_Time ResponseTime
... View more
06-21-2022
02:32 PM
Hi Marysan - Thanks for the reply, i got the solution | rex "START.*messageDetails\>\d+\-\d+\-\d+\s+(?<Start_Time>\d+\:\d+\:\d+)" | rex "END.*messageDetails\>\d+\-\d+\-\d+\s+(?<End_Time>\d+\:\d+\:\d+)" | eval ST = Strptime(Start_Time, "%H:%M:%S.%3N") | eval ET = Strptime(End_Time, "%H:%M:%S.%3N") | eval ResponseTime = tostring((ET -ST), "duration") | table _time host tag::host Start_Time End_Time ResponseTime
... View more
06-21-2022
08:36 AM
Hi @gcucello Can you also help me how to seperate the date and time in the regex. Cause i wanted to find the difference between Start_time and End_time | rex "START.*messageDetails\>(?<Start_Date>\d+\-\d+\-\d+\s+\d+\:\d+\:\d+)" My results : 2022-06-17 03:49:46
... View more
06-21-2022
07:51 AM
Thanks Gcusello ! i modifed your solutiion it worked. | rex "START.*messageDetails\>(?<Start_Date>\d+\-\d+\-\d+\s+\d+\:\d+\:\d+)" | rex "END.*messageDetails\>(?<End_Date>\d+\-\d+\-\d+\s+\d+\:\d+\:\d+)"
... View more
06-20-2022
04:33 PM
Hi Team - Need your expertise in Regex.
The below is the rawlog i need to extract the Date and time the only unique is the WORD "START" & "END" goal is to find the response time between START and END in a Table format.
Note: there are no space in the log
START</enteringExiting><logLevel>INFO</logLevel><messageType>LOG</messageType><applicationName>GstarSOA</applicationName<programName>GstarRecipientService_MF</programName><functionName>GetRecipient</functionName><host>PerfNode0</host><messageDetails>2022-06-17 04:10:53/utility/logging"><enteringExiting>END</enteringExiting><logLevel>INFO</logLevel><messageType>LOG</messageType><applicationName>GstarSOA</applicationName><programName>GstarRecipientService_MF</programName<functionName>GetRecipient</functionName><host>PerfNode0</host><messageDetails>2022-06-17 04:10:53
... View more
- Tags:
- Regex help
Labels
- Labels:
-
regex
04-20-2022
08:20 PM
Hi,
Can any one please help me with the query currently iam using " | rename * AS \|*\| " but i don't want \ in the header so i want like |PeriodDate| only.
\|PeriodDate\|
\|VendorName\|
\|ContractName\|
\|Code\|
|2021/12/19|
|SAM|
|HI-HI|
|511|
|2021/12/19|
|SAM|
|HI-HI|
|51.1|
|2021/12/19|
|SAM|
|HI-HI|
|51.1|
... View more
03-11-2022
12:04 PM
Hi @richgalloway I don't have much details of the props but the below screenshot shows the rex is working only for the first line.
... View more
03-11-2022
10:34 AM
Thanks, @ richgalloway. But here I am only getting the first line for the fields extracted in the log
... View more
03-11-2022
09:46 AM
i need the fields extracted by two fields
1) Detail message = before the comma ( I need the full description)
2) Count = after the comma ( I need the digit count)
RAW Log starts from below :
DETAIL MESSAGE, COUNT
Index 0 out of bounds for length 0, 61
No Recipienet found in MDM based on the input parameters, 120
No record found with this document Id, 86
No Records Found with given search Criteria in DB, 52
query did not return a unique result: 2; nested exception is javax.persistence.NonUniqueResultException: query did not return a unique result: 2, 106
You do not currently manage any user roles in PERLSS there is no task data to display at this time , 96
... View more
- Tags:
- rex
- splunk-search
Labels
- Labels:
-
field extraction
-
rex
02-15-2022
10:14 PM
Appreciate your help on the details @VatsalJagani. yes, we do have space after the /digit"space": : but I can add "s " in the provided query. Is there a way we can use get the regex on the UI for masking? cause I don't have access to the backend servers.
... View more
02-15-2022
09:03 PM
Hi All,
Can someone please help me in masking data and regex? currently, we have an event where I need to mask certain data in a field extraction. I have already worked on the basic regex forSample1 | rex field=_raw "("PAE"\/)(?<Mask_Data>\d+\W\w+\d\s)" but I am looking for a common or a separate regex for all the below samples and I want the events but mask the numbers before " : : " and after / I am good I can get only the numbers masked in the tail.
EVENT Samples
1) Request_URL=ghghghghghhghghghhghg/eeeee/xxx/functionalPAE/188888/WWE E 1112 : :
2) Request_URL=ghghghghghhghghghhghg/eeeee/xxx/functionalAssessment/188888 /EEE 3456823947 : :
3)Request_URL=ghghghghghhghghghhghg/eeeee/xxx/functionalAssessmentFromEEF/11111233 : :
4) Request_URL=ghghghghghhghghghhghg/eeeee/xxx/functionalAssessmentFromservices/1333/11233 : :
Thanks in advance.
... View more
