cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
Learnme_007
New Member
Member since: ‎07-18-2022
‎07-22-2022
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎07-18-2022
Activity Feed
View All

Re: How to Filter a specific field from event -

by in Splunk Enterprise
‎07-22-2022 03:52 AM
‎07-22-2022 03:52 AM
lnx001 Online Auto 1 50 1 1 2022-07-18 03:53:03 comp_123 comp_123 lnx003 Online Auto 1 50 1 1 2022-07-18 03:53:03 comp_456 comp_123 lnx005 Online Auto 1 20 1 1 2022-07-18 03:53:03 comp_123 comp_123 lnx007 Online Manual 1 50 0 1 2022-07-18 03:53:03 comp_987 lnx010 Online Manual 1 500 0 5 2022-07-18 03:53:03 comp_564 lnx011 Online Auto 643 4000 40 40 2022-07-18 03:53:03 comp_123   I want to extract the field post Auto, which shows numeric 1(the numeric value can vary from 1-20). there are multiple fields with numeric 1 or anything in between 1-99 other than this field. As of now I tried this, but this shows all the fields which starts with 1 or any other numeric which has a space before and after the character. it also matches anything starting from 1-99 \s\d{1,2}\s     ... View more

How to Filter a specific field from event -

by in Splunk Enterprise
‎07-18-2022 07:25 AM
‎07-18-2022 07:25 AM
I have a  file which gives me the following output :-  srvrmgr> list comps SHOW SV_NAME,CP_DISP_RUN_STATE,CP_STARTMODE,CP_NUM_RUN_TASKS,CP_MAX_TASKS,CP_ACTV_MTS_PROCS,CP_MAX_MTS_PROCS,CP_START_TIME,CP_END_TIME,CC_ALIAS SV_NAME CP_DISP_RUN_STATE CP_STARTMODE CP_NUM_RUN_TASKS CP_MAX_TASKS CP_ACTV_MTS_PROCS CP_MAX_MTS_PROCS CP_START_TIME CP_END_TIME CC_ALIAS -------- ------------------- ------------ ---------------- ------------ ----------------- ---------------- ------------------- ------------------- --------------- --------- lnx001 Online Auto 0 50 1 1 2022-07-18 03:53:03 comp_123 comp_123 lnx003 Online Auto 0 50 1 1 2022-07-18 03:53:03 comp_456 comp_123 lnx005 Online Auto 0 20 1 1 2022-07-18 03:53:03 comp_123 comp_123 lnx007 Online Manual 0 50 0 1 2022-07-18 03:53:03 comp_987 lnx010 Online Manual 0 500 0 5 2022-07-18 03:53:03 comp_564 lnx011 Online Auto 643 4000 40 40 2022-07-18 03:53:03 comp_123   I only want to extract the 1st,4th(numeric) and where comp_name=comp_123, discarding all the other entries and show 1st field as host, 4th field as runningtasks and final field as component.. Please help me with the filters ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎07-22-2022 07:13 AM