About marcosjags

marcosjags · ‎04-25-2022

@ITWhisperer I have tried this way. But it is still fetching the data from all the events . it is not excluding the other 2 events

marcosjags · ‎04-25-2022

@ITWhisperer SO in first part of the search I am getting DJ directly in my splunk log but for the other 2 events I am getting in url. for DONT_MATCH i am getting it as {"log":"{"logtime": "2022-04-25T09:53:47.629", "level": "[INFO]","dj": "310200019098846363"}}

marcosjags · ‎04-25-2022

@ITWhisperer So for these 2 Events EXTERNAL_API OR EXTERNAL_STATUS. I am getting a url something like this /api/sns/exts/djs/310200019110274535/ds/310200019110274536/ and variable is the value which I am extracting from this url which is 310200019110274535 in this case

marcosjags · ‎04-25-2022

@ITWhisperer I am trying to filter all the events which matches DONT_MATCH using DJ and then I am trying to filter DJ from EXTERNAL_API or EXTERNAL_STATUS and the one which will not match the DJ from EXTERNAL_API or EXTERNAL_STATUS should be my expected DJ. basically A same DJ can be in all the 3 events. What I want is only those DT which are in event DONT_MATCH and NOT IN EXTERNAL_API or EXTERNAL_STATUS

marcosjags · ‎04-25-2022

@PickleRick These separate events are having dj which is common for all the 3 events. if I do index=xt DONT_MATCH NOT EXTERNAL_API NOT EXTERNAL_STATUS | all that spath stuff Then also it will pull the DJ which at some point of time exists in all the 3. So what I want here is to pull all the DJ which is there in First even i.e DONT_MATCH and Does not exist in other 2. This is the expectation here. To fetch all the DJ from 1st event which does not exist in other 2.

marcosjags · ‎04-25-2022

Hi @PickleRick Actually there are 3 events name 1. DONT_MATCH 2. EXTERNAL_API 3. EXTERNAL_STATUS So I want to get values from the first event only. So I am filtering the DJ which I get in all the 3 events. What I want here is if the DJ is there in First event then ideally it should not be there in the other two and it should show all the values related to that DJ which will eventually help me in creating charts.

marcosjags · ‎04-25-2022

index=xt DONT_MATCH | spath input=log path=message.extra.dj output=dj | spath input=log output=fname path=message.msg.fname| search dj=* NOT [search EXTERNAL_API OR EXTERNAL_STATUS | spath input=log output=url path=url | dedup url | rex field=url "^(\/\w+){6}\/(?<variable>\d+)" | table url variable | stats list(variable) as variable] | stats count by fname The task here is to show the dj which is there in this event DONT_MATCH and it should not show those dj if it occurs in these 2 events EXTERNAL_API OR EXTERNAL_STATUS. So basically I want to show all the DJ which is there in DONT_MATCH and NOT IN EXTERNAL_API OR EXTERNAL_STATUS

marcosjags · ‎04-25-2022

Thanks for the help @gcusello . I will surely check the documentation

marcosjags · ‎04-25-2022

@gcusello How can i show that in the table next to url like this /api/sns/exts/djs/310200019110274535/ds/310200019110274536/ 310200019110274535 do I have to hold this in a variable and then should I do table url variable

marcosjags · ‎04-25-2022

Hello Everyone, I am new to splunk. I am searching the logs and I am getting my url like this /api/sns/exts/djs/310200019110274535/ds/310200019110274536/. What I want here is i want to extract the djs data which is 310200019110274535 in this case. Any help would be appreciated.

Posts	10
Solutions	0
Karma Given	3
Karma Received	0
Member Since	‎04-25-2022

Online Status	Offline
Date Last Visited	‎04-25-2022 12:54 PM

Why Splunk filter data NOT IN subquery?

How to extract data at specific position from url?

Re: Splunk filter data NOT IN subquery

Re: Splunk filter data NOT IN subquery

Re: Splunk filter data NOT IN subquery

Re: Splunk filter data NOT IN subquery

Re: Splunk filter data NOT IN subquery

Re: Splunk filter data NOT IN subquery

Why Splunk filter data NOT IN subquery?

Re: extract data at specific position from url

Re: extract data at specific position from url

How to extract data at specific position from url?

Are you a member of the Splunk Community?