Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Sanjana
Sanjana
Explorer
Member since:
08-29-2022
10-07-2022
Community Statistics
| Posts | 15 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 08-29-2022 |
Activity Feed
- Posted Splunk search- How to extract payload? on Splunk Search. 10-06-2022 05:39 AM
- Tagged Splunk search- How to extract payload? on Splunk Search. 10-06-2022 05:39 AM
- Tagged Splunk search- How to extract payload? on Splunk Search. 10-06-2022 05:39 AM
- Tagged Splunk search- How to extract payload? on Splunk Search. 10-06-2022 05:39 AM
- Tagged Splunk search- How to extract payload? on Splunk Search. 10-06-2022 05:39 AM
- Tagged Splunk search- How to extract payload? on Splunk Search. 10-06-2022 05:39 AM
- Posted Re: Splunk json dymanic field extraction on Splunk Search. 09-27-2022 07:49 AM
- Tagged Re: Splunk json dymanic field extraction on Splunk Search. 09-27-2022 07:49 AM
- Tagged Re: Splunk json dymanic field extraction on Splunk Search. 09-27-2022 07:49 AM
- Tagged Re: Splunk json dymanic field extraction on Splunk Search. 09-27-2022 07:49 AM
- Tagged Re: Splunk json dymanic field extraction on Splunk Search. 09-27-2022 07:49 AM
- Tagged Re: Splunk json dymanic field extraction on Splunk Search. 09-27-2022 07:49 AM
- Posted Re: Splunk json dymanic field extraction on Splunk Search. 09-27-2022 02:46 AM
- Posted Re: Help with splunk search- How to convert check-ins index into date then calculate desync for each day? on Splunk Search. 09-27-2022 01:42 AM
- Posted Re: Help with splunk search- How to convert check-ins index into date then calculate desync for each day? on Splunk Search. 09-26-2022 10:15 PM
- Posted Help with Splunk json dymanic field extraction on Splunk Search. 09-26-2022 10:09 PM
- Posted Re: Help with splunk search- How to convert check-ins index into date then calculate desync for each day? on Splunk Search. 09-26-2022 09:21 PM
- Tagged Re: Help with splunk search- How to convert check-ins index into date then calculate desync for each day? on Splunk Search. 09-26-2022 09:21 PM
- Posted How to convert check-ins index into date then calculate desync for each day? on Splunk Search. 09-26-2022 06:48 AM
- Posted Re: Splunk Search-Where is key dynamic? on Splunk Search. 09-14-2022 11:25 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-06-2022
05:39 AM
Hello ,
I have splunk logger line like below:
Address: XXX HttpMethod: POST Headers: {Ama-Internal-REST-Service=hotel/booking, , Ama-Internal-Protocol=HTTP, Message-Type=RPWREQ} Payload: {"channel":"noChannel","conversationId":"12345","version":"1.0","agent":"noAgent","date":"2023-01-01","events":[{"action":"Update","objectAfter":{"chainCode":"BLR","brandCode":"ES","propertyCode":"HYATT"},"type":"Property"}]}
I need to extract payload after Payload:
And then stats as table where columns are all field in payload. for eg:
TABLE OUTPUT:
channel conversationId version date chaincode propertycode type
... View more
09-27-2022
07:49 AM
Hey @kamlesh_vaghela Thanks for the response. It worked fine. Sorry to bug you again. I have two queries running separate fine. 1. Query MY_SEARCH | spath content.kIndexKey_EventMessage{1}.check-ins | spath input=content.kIndexKey_EventMessage{1}.check-ins | spath output=period_start path=content.kIndexKey_EventMessage{1}.period.start | eval period_start = strptime('period_start', "%F") | foreach *.avail [ eval suffix = mvappend(suffix, "<<MATCHSTR>>")] | mvexpand suffix | eval datevalue = period_start + 86400 * suffix | fields datevalue | fieldformat datevalue = strftime(datevalue, "%F") |table datevalue Output datevalue 2022-09-27 2022-09-28 2022-09-29 2022-09-30 2.Query: My_Search | fields _raw |spath output=chain path=content.kIndexKey_EventMessage{1}.chain |spath output=start path=content.kIndexKey_EventMessage{1}.period.start | where like(chain, "IHG%") | spath content.kIndexKey_EventMessage{1}.check-ins | spath input=content.kIndexKey_EventMessage{1}.check-ins | foreach *.check-ins [| eval "<<MATCHSEG1>>"='<<FIELD>>'+'start'] | foreach *.avail [| eval "<<MATCHSEG1>>"='<<FIELD>>'] | foreach *.price [| eval "<<MATCHSEG1>>"='<<MATCHSEG1>>'+'<<FIELD>>'] | dedup _raw,_time | fields - *.avail *.price check_ins check-ins _time | untable _raw check_ins nb_desync | search nb_desync > 0 | stats sum(nb_desync) as nb_desync by check_ins | sort -nb_desync |join type=left [search index="int-acrs-cde_appevent-shared" |spath output=chain path=content.kIndexKey_EventMessage{1}.chain | where like(chain, "IHG") |spath output=nb_avail_desync path=content.kIndexKey_EventMessage{1}.total.avail |spath output=nb_price_desync path=content.kIndexKey_EventMessage{1}.total.price | eval tot_desync=nb_avail_desync+nb_price_desync | stats sum(tot_desync) as total ] | eval percent = round(nb_desync*100/total,1) | search percent > 0 | fields - total_Desync , percent,total Output: check_ins nb_desync 0 13 1 13 2 13 I am trying to combine both query such that my output should look something as mentioned below: 1st column from 1st query as date 2nd column form 2nd query as nb_desync datevalue nb_desync 2022-09-27 13 2022-09-28 13 2022-09-29 13 2022-09-30 13 Thanks in advance!! Looking for your response.
... View more
09-27-2022
02:46 AM
Hello @yuanliu , I tried above response.but no luck. I am giving you exact scenario which I m trying to work. This is my actual json structure of splunk data. "content": {"kIndexKey_EventMessage": { "period":{"start":"2022-10-03","end":"2022-10-19"}, "check-ins":{ "12":{"avail":13,"price":0}, "13":{"avail":13,"price":0}, "14":{"avail":13,"price":0}, "15":{"avail":13,"price":0}, "16":{"avail":13,"price":0}, "17":{"avail":13,"price":0}, "18":{"avail":13,"price":0}, "19":{"avail":13,"price":0}, "20":{"avail":13,"price":0}, "21":{"avail":13,"price":0}, "22":{"avail":13,"price":0}, "23":{"avail":13,"price":0}, "24":{"avail":13,"price":0}, "25":{"avail":13,"price":0}, "26":{"avail":13,"price":0}, "27":{"avail":13,"price":0}, "28":{"avail":13,"price":0} } } My search is something like below: index="index1" | fields _raw | spath content.kIndexKey_EventMessage{1}.check-ins | spath input=content.kIndexKey_EventMessage{1}.check-ins |spath output=period_start path=content.kIndexKey_EventMessage{1}.period.start | eval period_start = strptime('period.start', "%F") | foreach check-ins.*.avail [eval suffix = mvappend(suffix, "<<MATCHSTR>>")] | mvexpand suffix | eval datevalue = period_start + 86400 * suffix | fields datevalue | fieldformat datevalue = strftime(datevalue, "%F") After executing this ->Getting below erro without any data as you shown Field 'suffix' does not exist in the data. Could you please help me where I m getting wrong in this query
... View more
09-27-2022
01:42 AM
Hey @yuanliu Yes correct. With sample data output is coming as expected. But when I am using on my actual data then error comes as desync does not exist. Not sure why................
... View more
09-26-2022
10:15 PM
Hello @yuanliu I am getting error Field 'desync' does not exist in the data, using above query. I think desync used in mvappend function is not in my data. [eval desync = mvappend(desync, period_start + <<MATCHSTR>> * 86400 . ":" . '<<FIELD>>' + 'check-ins.<<MATCHSTR>>.price')]
... View more
09-26-2022
10:09 PM
Hey all,
I am trying to extract dynamic field from json .
{"period":{"start":"2023-04-17","end":"2023-05-14"},"check-ins":{"203":{"avail":5,"price":5},"204":{"avail":5,"price":5},"205":{"avail":5,"price":5},"206":{"avail":5,"price":5},"207":{"avail":5,"price":5},"208":{"avail":5,"price":5},"209":{"avail":5,"price":5},"210":{"avail":5,"price":5},"211":{"avail":5,"price":5},"212":{"avail":5,"price":5},"213":{"avail":5,"price":5},"214":{"avail":5,"price":5},"215":{"avail":5,"price":5},"216":{"avail":5,"price":5},"217":{"avail":5,"price":5},"218":{"avail":5,"price":5},"219":{"avail":19,"price":5},"220":{"avail":19,"price":5},"221":{"avail":19,"price":5},"222":{"avail":19,"price":5},"223":{"avail":19,"price":5},"224":{"avail":19,"price":5},"225":{"avail":19,"price":5},"226":{"avail":19,"price":5},"227":{"avail":19,"price":5},"228":{"avail":19,"price":5},"229":{"avail":20,"price":5},"230":{"avail":20,"price":5}}}
I need to extract 203,204,205.........till 230 as per data mentioned above then each extracted value will be added in period.start field . At the end I need that date value after addition
Thanks in advance
... View more
09-26-2022
09:21 PM
Hey @yuanliu Thanks for the quick response. But I think there is some miscommunication about the expected result. Could you please help me with actual result after calculation. The calculation part (avai+price) not needed to display in result. just the final answer. Total value of after adding avail and price value should come with corresponding date property Date desync XYZ 2022-09-16 3
... View more
- Tags:
- y
09-26-2022
06:48 AM
Hello,
I have data like below.
{"property":"XYZ", "period":{ "start":"2022-09-16", "end":"2022-10-02" }, "nb-day":17, "nb-rate-plans":518, "nb-products":16, "total":{ "avail":48, "price":0 }, "filtered":{ "avail":0, "price":0 }, "rate-plans":{ "IWU35":{ "avail":16, "price":0 }, "IWU30":{ "avail":16, "price":0 }, "IWU40":{ "avail":16, "price":0 } }, "check-ins":{ "0":{ "avail":3, "price":0 }, "1":{ "avail":3, "price":0 }, "2":{ "avail":3, "price":0 }, "3":{ "avail":3, "price":0 }, "4":{ "avail":3, "price":0 }, "5":{ "avail":3, "price":0 }, "6":{ "avail":3, "price":0 }, "7":{ "avail":3, "price":0 }, "8":{ "avail":3, "price":0 }, "9":{ "avail":3, "price":0 }, "10":{ "avail":3, "price":0 }, "11":{ "avail":3, "price":0 }, "12":{ "avail":3, "price":0 }, "13":{ "avail":3, "price":0 }, "14":{ "avail":3, "price":0 }, "15":{ "avail":3, "price":0 } } }
{ "property":"ABC", "period":{ "start":"2022-09-16", "end":"2022-10-02" }, "nb-day":17, "nb-rate-plans":518, "nb-products":16, "total":{ "avail":48, "price":0 }, "filtered":{ "avail":0, "price":0 }, "rate-plans":{ "IWU35":{ "avail":16, "price":0 }, "IWU30":{ "avail":16, "price":0 }, "IWU40":{ "avail":16, "price":0 } }, "check-ins":{ "0":{ "avail":3, "price":0 }, "1":{ "avail":3, "price":0 }, "2":{ "avail":3, "price":0 }, "3":{ "avail":3, "price":0 }, "4":{ "avail":3, "price":0 }, "5":{ "avail":3, "price":0 }, "6":{ "avail":3, "price":0 }, "7":{ "avail":3, "price":0 }, "8":{ "avail":3, "price":0 }, "9":{ "avail":3, "price":0 }, "10":{ "avail":3, "price":0 }, "11":{ "avail":3, "price":0 }, "12":{ "avail":3, "price":0 }, "13":{ "avail":3, "price":0 }, "14":{ "avail":3, "price":0 }, "15":{ "avail":3, "price":0 } } }
1. Need to calculate date based on below example->
start : 2022-09-16
"check-ins":{ "0":{ "avail":3, "price":0 }, "1":{ "avail":3, "price":0 }, "2":{ "avail":3, "price":0 }, "3":{ "avail":3, "price":0 }, "4":{ "avail":3, "price":0 }, "5":{ "avail":3, "price":0 }, "6":{ "avail":3, "price":0 }, "7":{ "avail":3, "price":0 }, "8":{ "avail":3, "price":0 }, "9":{ "avail":3, "price":0 }, "10":{ "avail":3, "price":0 }, "11":{ "avail":3, "price":0 }, "12":{ "avail":3, "price":0 }, "13":{ "avail":3, "price":0 }, "14":{ "avail":3, "price":0 }, "15":{ "avail":3, "price":0 } }
Index from check-ins need to be added in start-date
Date: desync
2022-09-16 + 0 = 2022-09-16 avail+price(3+0)
2022-09-16 + 1 =2022-09-17
2022-09-16 + 2= 2022-09-18
2022-09-16 + 15 = 2022-10-01
I need to convert check-ins index into date and then calculate desync for each day
Thanks in advance!!
... View more
09-14-2022
11:25 PM
Hello @ITWhisperer I am working on another splunk query , looking some input from your side. have Logger lines as below: job MONITOR-DESYNC-3-20I-ERNC: { "chain":"PR1", "nbProperties":1345, "propertyStartCount":1, "nbPropertyPerExecution":5, "propertyEndCount":6, "nbPropertyForCurrentExecution":5 } job MONITOR-DESYNC-3-20I-ERNC: { "chain":"PR2", "nbProperties":1345, "propertyStartCount":6, "nbPropertyPerExecution":5, "propertyEndCount":11, "nbPropertyForCurrentExecution":5 } ------These lines continue till propertyEndCount = nbProperties but sometimes it does not get equal and stops. This job stopped at "propertyEndCount":1076 only job MONITOR-DESYNC-3-6AQ-Q7Z: { "chain":"PR1", "nbProperties":1345, "propertyStartCount":1071, "nbPropertyPerExecution":5, "propertyEndCount":1076, "nbPropertyForCurrentExecution":5 } SPlunk query to find if all hotels got covered for each chain . In this case Output Expected is: only if propertyEndCount < nbProperties then I need to get output as below chain total-property end-property PR1 1345 1076 PR2 1345 1000 I have tried like below : index="index1" "propertyEndCount" "MONITOR-DESYNC-3*" | rex field=_raw "(?<json>\{.*\})" | spath input=json output=nb_property "nbProperties" | spath input=json output=nb_endproperty "propertyEndCount" | spath input=json output=chain "chain" | bucket _time span=day | eval nb_end = max(nb_endproperty) | search nb_end < nb_property | reverse | stats latest(nb_property) as property_scheduled latest(nb_endproperty) as property_covered by chain but from this still I m getting record evenif propertyEndCount > nbProperties could you please help me on this. Thanks in advance!!
... View more
09-08-2022
02:11 AM
Hello @ITWhisperer Thanks for the solution. IT worked perfectly fine. But If I am having duplicated logs ,in that case facing trouble. Duplicate record should not get added. 2022/09/01 21:18:22.199000 [ABC:XXX-XXXX:DESYNC-20I-ST8F-I2] "rate-parity-group":{ "CJ":{ "avail":4, "price":0 }, "CK":{ "avail":8, "price":0 }, "CL":{ "avail":8, "price":0 }, "CM":{ "avail":12, "price":0 } } } 2022/09/01 21:18:22.199000 [ABC:XXX-XXXX:DESYNC-20I-ST8F-I2] "rate-parity-group":{ "CJ":{ "avail":4, "price":0 }, "CK":{ "avail":8, "price":0 }, "CL":{ "avail":8, "price":0 }, "CM":{ "avail":12, "price":0 } } } how should I handle it?
... View more
09-05-2022
06:58 AM
Hello @gcusello Thanks for the response. But I am not able to fetch data as expected. No statistics is coming
... View more
09-05-2022
04:56 AM
Hello folks, I have Logger lines as below: job MONITOR-DESYNC-3-20I-ERNC: { "chain":"PR1", "nbProperties":1345, "propertyStartCount":1, "nbPropertyPerExecution":5, "propertyEndCount":6, "nbPropertyForCurrentExecution":5 } job MONITOR-DESYNC-3-20I-ERNC: { "chain":"PR2", "nbProperties":1345, "propertyStartCount":6, "nbPropertyPerExecution":5, "propertyEndCount":11, "nbPropertyForCurrentExecution":5 } ------These lines continue till propertyEndCount = nbProperties but sometimes it does not get equal and stops randomly like below. This job stopped at "propertyEndCount":1076 only job MONITOR-DESYNC-3-6AQ-Q7Z: { "chain":"PR1", "nbProperties":1345, "propertyStartCount":1071, "nbPropertyPerExecution":5, "propertyEndCount":1076, "nbPropertyForCurrentExecution":5 } SPlunk query to find how many hotels got covered for each chain . In this case Output Expected is: chain total-property covered-property PR1 1345 1076 PR2 1345 1000 I am quite new to splunk query. I think If somehow I could fetch the value of propertyEndCount from the last event then it should work. If anyone can provide some solution to get as expected result mentioned above. Thanks in Advance.
... View more
Labels
- Labels:
-
count
-
field extraction
-
rex
-
tstats
08-29-2022
05:59 AM
Hey Again, Expected output is avail+price for each group .And then calculate percentage with total from data
... View more
08-29-2022
04:15 AM
Hey @ITWhisperer , Thanks for the quick response. I am not getting right output with this. {\"rate-parity-group\":{\"CN\":{\"avail\":11,\"price\":11}}} For this record my outcome should look like below CN 22 . For each group I need to add both avail and price count. To give you more insight . This is hoe I have nested json fields. After Rate-parity-group level calculation, I am supposed to find percentage as well. To find percentage I have to use "total" object mentioned in scree. Also I have a small doubt, you have used below as spath | fields _raw
| spath rate-parity-group
| spath input=rate-parity-group This is how I used but output is not as expected index="index1" | multikv noheader=t | fields _raw | spath content.kIndexKey_EventMessage{1}.rate-parity-group | spath input=content.kIndexKey_EventMessage{1}.rate-parity-group | foreach *.avail [| eval group="<<MATCHSEG1>>" | eval {group}='<<FIELD>>'] | fields - *.avail *.price group rate-parity-group _time | untable _raw group avail | stats sum(avail) as avail by group
... View more
- Tags:
- json
08-29-2022
01:00 AM
Hello ,
I have data like below. I need to frame a query such that I can calculate number of desync for each rate-parity-group.
For example:
"rate-parity-group":{"CN":{"avail":11,"price":11}}}
rate-parity-group":{"CK":{"avail":18,"price":0},"CL":{"avail":36,"price":0},"CM":{"avail":18,"price":0}}},
"rate-parity-group":{"CL":{"avail":18,"price":0},"CM":{"avail":36,"price":0}}}
Expected outcome
rate-parity-group total-desync
CL 54(36+18)
CM 54
CK 18
Since CK,CM,CL all these rate-parity-group is dynamic so I m facing problem.
Could someone help me to get the desync count at rate-parity-group.
Sample data attached in screenshot.
Thanks in Advance
... View more
Labels
- Labels:
-
eval
-
field extraction
-
join
-
rex
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-07-2022
07:40 AM
|
