Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About shashaikhhh
shashaikhhh
Explorer
Member since:
05-18-2022
06-27-2022
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 3 |
| Karma Received | 0 |
| Member Since | 05-18-2022 |
Activity Feed
- Posted Re: A table data with multiple JSON fields on Splunk Search. 06-27-2022 03:39 AM
- Tagged Re: A table data with multiple JSON fields on Splunk Search. 06-27-2022 03:39 AM
- Tagged Re: A table data with multiple JSON fields on Splunk Search. 06-27-2022 03:39 AM
- Tagged Re: A table data with multiple JSON fields on Splunk Search. 06-27-2022 03:39 AM
- Posted Help with A table data with multiple JSON fields on Splunk Search. 06-23-2022 11:56 PM
- Tagged Help with A table data with multiple JSON fields on Splunk Search. 06-23-2022 11:56 PM
- Tagged Help with A table data with multiple JSON fields on Splunk Search. 06-23-2022 11:56 PM
- Tagged Help with A table data with multiple JSON fields on Splunk Search. 06-23-2022 11:56 PM
- Tagged Splunk Query to form a table with multiple JSON fields on Splunk Search. 06-19-2022 10:40 PM
- Tagged Splunk Query to form a table with multiple JSON fields on Splunk Search. 06-19-2022 10:40 PM
- Karma Re: Splunk Query to form a table with multiple JSON fields for ITWhisperer. 06-19-2022 10:39 PM
- Posted Re: Splunk Query to form a table with multiple JSON fields on Splunk Search. 06-16-2022 08:54 AM
- Posted Re: Splunk Query to form a table with multiple JSON fields on Splunk Search. 06-16-2022 08:50 AM
- Posted Splunk Query to form a table with multiple JSON fields on Splunk Search. 06-16-2022 06:58 AM
- Posted Re: How to display a table with status reason and count of different status reasons like "NO_ID_UPLOADED", &am on Splunk Search. 05-19-2022 02:47 AM
- Karma Re: How to display a table with status reason and count of different status reasons like "NO_ID_UPLOADED", &am for ITWhisperer. 05-19-2022 02:46 AM
- Posted Re: How to display a table with status reason and count of different status reasons like "NO_ID_UPLOADED", &qu on Splunk Search. 05-19-2022 02:31 AM
- Tagged Re: How to display a table with status reason and count of different status reasons like "NO_ID_UPLOADED", &qu on Splunk Search. 05-19-2022 02:31 AM
- Tagged Re: How to display a table with status reason and count of different status reasons like "NO_ID_UPLOADED", &qu on Splunk Search. 05-19-2022 02:31 AM
- Tagged Re: How to display a table with status reason and count of different status reasons like "NO_ID_UPLOADED", &qu on Splunk Search. 05-19-2022 02:31 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
06-27-2022
03:39 AM
{"additional":{"method":"POST","url":"/api/login/user","headers":{"accept-encoding":"gzip, deflate, br","appcontext":"marketplace","cloudfront-forwarded-proto":"https","cloudfront-is-desktop-viewer":"true","cloudfront-is-mobile-viewer":"false","cloudfront-is-smarttv-viewer":"false","cloudfront-is-tablet-viewer":"false","cloudfront-viewer-country":"","content-type":"application/json","origin":"https://www.myprepaidcenter.com","sec-ch-ua":"\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"102\", \"Google Chrome\";v=\"102\"","sec-ch-ua-mobile":"?0","sec-ch-ua-platform":"\"Windows\"","sec-fetch-dest":"empty","sec-fetch-mode":"cors",,"connection":"Keep-Alive"},"body":{"agg":"prod-pri-b-10.185.32.135","index":"bhn_apps","host":"production-HI-Marketplace-Y"}
... View more
06-23-2022
11:56 PM
I need count of cloudfront-viewer-country and sec-ch-ua-platform for each Origin Please help.
Expected Result:
If site1 has only 2 countries and site2 has one extra platform, then the expected result should be like below.
Origin
Platform
Platform Count
Country
Country Count
https://www.site1.com
Android
10
US
22
macOS
12
UK
3
Windows
6
https://www.site2.com
Android
4
US
8
macOS
4
UK
1
Windows
2
AU
1
IND
5
Data:
{ "additional": { "method": "POST", "url": "/api/resource/getContentEditorData", "headers": { "cloudfront-viewer-country": "US", "origin": "https://www.site1.com", "sec-ch-ua-platform": "\"Android\"" } }, "level": "notice", "message": "INCOMING REQUEST: POST /api/resource/getContentEditorData" } ============
{ "additional": { "method": "POST", "url": "/api/resource/getContentEditorData", "headers": { "cloudfront-viewer-country": "UK", "origin": "https://www.site1.com", "sec-ch-ua-platform": "\"Windows\"" } }, "level": "notice", "message": "INCOMING REQUEST: POST /api/resource/getContentEditorData" }
=========================
{ "additional": { "method": "POST", "url": "/api/resource/getContentEditorData", "headers": { "cloudfront-viewer-country": "AU", "origin": "https://www.site2.com", "sec-ch-ua-platform": "\"Windows\"" } }, "level": "notice", "message": "INCOMING REQUEST: POST /api/resource/getContentEditorData" }
... View more
06-16-2022
08:54 AM
If site1 has only 2 countries and site2 has one extra platform, then the expected result should be like below. Origin Platform Platform Count Country Country Count https://www.site1.com Android 10 US 22 macOS 12 UK 3 Windows 6 https://www.site2.com Android 4 US 8 macOS 4 UK 1 Windows 2 AU 1 IND 5
... View more
06-16-2022
08:50 AM
If site1 has only 2 countries, then we need to display 2 records. Updated Splunk event data: { "additional": { "method": "POST", "url": "/api/resource/getContentEditorData", "headers": { "cloudfront-viewer-country": "US", "origin": "https://www.site1.com", "sec-ch-ua-platform": "\"Android\"" } }, "level": "notice", "message": "INCOMING REQUEST: POST /api/resource/getContentEditorData" } ============ { "additional": { "method": "POST", "url": "/api/resource/getContentEditorData", "headers": { "cloudfront-viewer-country": "UK", "origin": "https://www.site1.com", "sec-ch-ua-platform": "\"Windows\"" } }, "level": "notice", "message": "INCOMING REQUEST: POST /api/resource/getContentEditorData" } ========================= { "additional": { "method": "POST", "url": "/api/resource/getContentEditorData", "headers": { "cloudfront-viewer-country": "AU", "origin": "https://www.site2.com", "sec-ch-ua-platform": "\"Windows\"" } }, "level": "notice", "message": "INCOMING REQUEST: POST /api/resource/getContentEditorData" }
... View more
06-16-2022
06:58 AM
Below is my splunk raw event data { "additional": { "method": "POST", "url": "/api/resource/getContentEditorData", "headers": { "cloudfront-viewer-country": "US", "origin": "https://www.site1.com", "sec-ch-ua-platform": "\"Android\"", } }, "level": "notice", "message": "INCOMING REQUEST: POST /api/resource/getContentEditorData" } I need count of cloudfront-viewer-country and sec-ch-ua-platform for each Origin Please help. Expected Result: Origin Platform Platform Count Country Country Count https://www.site1.com Android 10 US 22 macOS 12 UK 3 Windows 6 AU 1 https://www.site2.com Android 4 US 8 macOS 4 UK 1 Windows 2 AU 1
... View more
- Tags:
- multivalue
- table
05-19-2022
02:47 AM
What a legend! thank you!
... View more
05-19-2022
02:31 AM
Tried, not working. Please find the raw events data {"sessionId":"cl3cmekh8nvgbaxf1bm", "requestId":"cleh8nv1526885k", "additional": {"ResponseMetadata": {"RequestId":"ffcdff50-d-a5af2808ad5c"},"Messages":[ {"MessageId":"bf-f7ec-4a45-a546-08a2d6e4", "Body":"{\n \"clientName\" : \"mpc\",\n \"tenantId\" : \"9TQ389G0BZH3XSHK57Y88Z1H5M\",\n \"mid\" : \"60300004707-bhn\",\n \"userId\" : \"1432778\",\n \"transactionReferenceId\" : \"ACBJBG91X2N8TT591A3DJYXGR0\",\n \"verificationResult\" : \"FAIL\",\n \"verificationResultTimestamp\" : \"2022-05-19T05:44:24.090Z\",\n \"statusReason\" : \"NO_ID_UPLOADED\"\n}"} ] },"level":"info","message":"SQS Result Data","platform":"HI-Marketplace","project":"YourCardHub","instance_id":"i-05e770b3db412","index":"bhn_apps","host":"production-HI-Marketplace-YourCardHub-cirr"}
... View more
05-19-2022
12:03 AM
Hi, This is splunk query and it returns nested JSON object
Query: sourcetype=_json_fluentd source="***" | search message="SQS Result Data" "FAIL" Response: { [-] additional: { [-] Messages: [ [-] { [-] Body: { "clientName" : "mpc", "tenantId" : "assd", "mid" : "asd-bhn", "userId" : "112778", "transactionReferenceId" : "trans1223", "verificationResult" : "FAIL", "verificationResultTimestamp" : "2022-05-19T05:44:24.090Z", "statusReason" : "NO_ID_UPLOADED" } ] } level: info message: SQS Result Data } I want to display a table with status reason and count of different status reasons like "NO_ID_UPLOADED", "FRAUD_ID". Please share your answers.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-27-2022
07:54 AM
|
