Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About anitha123gnana
anitha123gnana
Loves-to-Learn Lots
Member since:
04-30-2022
05-02-2022
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 04-30-2022 |
Activity Feed
- Posted Re: I have block of 10 lines. What is the splunk command to get only 3 line where line starts from keyword ERROR? on Splunk Search. 05-02-2022 04:30 AM
- Posted What is the configuartion to upload log files from Linux server to splunk on a regular basis automatically? on Getting Data In. 05-02-2022 03:16 AM
- Posted Re: I have block of 10 lines. What is the splunk command to get only 3 line where line starts from keyword ERROR? on Splunk Search. 05-02-2022 03:06 AM
- Posted Re: I have block of 10 lines. What is the splunk command to get only 3 line where line starts from keyword ERROR? on Splunk Search. 05-02-2022 02:28 AM
- Posted Re: I have block of 10 lines. What is the splunk command to get only 3 line where line starts from keyword ERROR? on Splunk Search. 05-01-2022 11:06 PM
- Posted Re: I have block of 10 lines. What is the splunk command to get only 3 line where line starts from keyword ERROR? on Splunk Search. 05-01-2022 10:51 PM
- Posted Re: I have block of 10 lines. What is the splunk command to get only 3 line where line starts from keyword ERROR? on Splunk Search. 04-30-2022 08:40 PM
- Posted With 10 blocks of lines, what is the Splunk command to get only 3 line where line starts from keyword ERROR? on Splunk Search. 04-30-2022 02:21 AM
Topics I've Started
05-02-2022
04:30 AM
Simple search does not work as we have many jobs running in multiple threads recorded in the log file. We are targeting a specific job in one thread and try to extract first 4 lines of its error messages.
... View more
05-02-2022
03:16 AM
We have log files generated in the Linux server. We want to push it into Splunk based on a regular time interval automatically. Thanks in advance
... View more
Labels
- Labels:
-
indexer
-
intermediate forwarder
-
Linux
-
sourcetype
05-02-2022
03:06 AM
Our expected result is the ERROR row with the following three rows
... View more
05-02-2022
02:28 AM
Sorry, Our expected result is the ERROR row with the following three rows But, the below query is returning the first transaction block as result . The second transaction command is not working. index=my_index sourcetype="debugLog" (ERROR OR DEBUG) | transaction Threadnumber startswith="User job started" endswith="User job ended" | eval myRaw = _raw | mvexpand myRaw | rename myRaw as _raw | transaction startswith="ERROR" maxevents=4 Thanks in advance
... View more
05-01-2022
11:06 PM
I tried this query before but it is not working.
... View more
05-01-2022
10:51 PM
I'm getting the below output for the query that you have given. 2022-02-14 02:30:00,046 [Worker-3] DEBUG User job started 2022-02-14 02:30:00,063 [Worker-3] DEBUG Calling importData 2022-02-14 02:30:00,063 [Worker-3] DEBUG Initializing External DB connection 2022-02-14 02:30:00,063 [Worker-3] ERROR Exception occured 2022-02-14 02:30:00,063 [Worker-3] DEBUG Calling importData 2022-02-14 02:30:00,063 [Worker-3] DEBUG Initializing External DB connection 2022-02-14 02:30:00,067 [Worker-3] DEBUG url before binding 2022-02-14 02:30:00,067 [Worker-3] DEBUG url before binding 2022-02-14 02:30:00,560 [Worker-3] DEBUG inside finally... 2022-02-14 02:30:00,560 [Worker-3] DEBUG inside finally... 2022-02-14 02:30:00,567 [Worker-3] DEBUG sending Notification Email 2022-02-14 02:30:00,567 [Worker-3] DEBUG User job ended But, the expected output is only the error message from that transaction. 2022-02-14 02:30:00,063 [Worker-3] ERROR Exception occured Thanks in advance.
... View more
04-30-2022
08:40 PM
Thank you for the quick reply. But, the block of 10 lines is the result of the below query. index=my_index sourcetype="debugLog" | transaction Threadnumber startswith="User job started" endswith="User job ended" Threadnumber -> [Worker-3] How do I add logic to this query so that only error messages are extracted from this block? Thanks in advance
... View more
04-30-2022
02:21 AM
Block:
2022-02-14 02:30:00,046 [Worker-3] DEBUG User job started 2022-02-14 02:30:00,063 [Worker-3] DEBUG Calling importData 2022-02-14 02:30:00,063 [Worker-3] DEBUG Initializing External DB connection 2022-02-14 02:30:00,063 [Worker-3] ERROR Exception occured 2022-02-14 02:30:00,067 [Worker-3] DEBUG url before binding 2022-02-14 02:30:00,560 [Worker-3] DEBUG inside finally... 2022-02-14 02:30:00,567 [Worker-3] DEBUG sending Notification Email 2022-02-14 02:30:00,567 [Worker-3] DEBUG User job ended 2022-02-14 02:30:00,046 [Worker-3] DEBUG User job started 2022-02-14 02:30:00,063 [Worker-3] DEBUG Calling importData 2022-02-14 02:30:00,063 [Worker-3] DEBUG Initializing External DB connection 2022-02-14 02:30:00,067 [Worker-3] DEBUG url before binding 2022-02-14 02:30:00,560 [Worker-3] DEBUG inside finally... 2022-02-14 02:30:00,567 [Worker-3] DEBUG sending Notification Email 2022-02-14 02:30:00,567 [Worker-3] DEBUG User job ended
Expected output:
2022-02-14 02:30:00,063 [Worker-3] ERROR Exception occured 2022-02-14 02:30:00,067 [Worker-3] DEBUG url before binding 2022-02-14 02:30:00,560 [Worker-3] DEBUG inside finally... 2022-02-14 02:30:00,567 [Worker-3] DEBUG sending Notification Email
Thanks in advance
... View more
Labels
- Labels:
-
regex
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-02-2022
09:36 AM
|
