×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
sasank
Explorer
Member since: ‎12-22-2022
‎01-11-2023
Community Statistics
Posts 8
Solutions 0
Karma Given 1
Karma Received 2
Member Since ‎12-22-2022
Activity Feed
View All

Re: Regex to match string between 2 strings

by in Splunk Search
‎01-11-2023 03:47 AM
‎01-11-2023 03:47 AM
Thanks for the link. I couldn't figure out how to match the 2nd value so I am looking if someone can help in fixing the regex ... View more

Regex to match string between 2 strings?

by in Splunk Search
‎01-11-2023 03:35 AM
‎01-11-2023 03:35 AM
Hi, I have below splunk command: | makeresults | eval _raw="The first value is 0.00 and The second value is 0\",\"origin\":\"rep\",\"source_instance\":\"0\"" | rex "The\sfirst\svalue\sis (?<from>.*) and\sThe\ssecond\svalue\sis (?<to>.*)"   This shows the "from" field as 0.00 and "to" field as 0","origin":"rep","source_instance":"0" In the "to" field I only want the value 0. How do I achieve that? ... View more
Labels

How to use 'AND' keyword in Transaction command

by in Splunk Search
‎12-29-2022 01:31 AM
‎12-29-2022 01:31 AM
Hi, I want to use 'AND' keyword either in startsWith or in endsWith. <<search>> | transaction startsWith="some text" AND "some other text" endswith="some text" AND "some other text" Is this possible?   ... View more
Labels

Re: Search for splunk event which has greater than...

by in Splunk Search
‎12-25-2022 12:02 AM
1 Karma
‎12-25-2022 12:02 AM
1 Karma
Hi, I saw the RAW event and found that the text in the event is "Application -\u003e start of the log" The greater than symbol is in unicode. So I have to search as "Application -\\u003e start of the log". Thank you. ... View more

Re: Rendering of JSON data in Splunk Web

by in Splunk Search
‎12-24-2022 11:24 PM
‎12-24-2022 11:24 PM
Hi, I want to use "List" view so that I can get Syntax highlighting for JSON Splunk events. ('Show as raw text' is same as using the "raw" view). I think this is a bug in Splunk GUI. Atleast upto 2 levels should have been maximised by Splunk by default instead of forcing user to keep clicking plus icon. Or atleast make this configurable in user preferences  ... View more

Search for splunk event which has greater than sym...

by in Splunk Search
‎12-24-2022 11:38 AM
‎12-24-2022 11:38 AM
Hi, I have a Splunk event "Application -> start of the log". When I try to search for this log using the exact text then I do not get any results. I see that the greater than symbol is causing the problem. When I split my search command as "Application -" AND "start of the log" then splunk was able to find the event. So how do I escape the greater than symbol in splunk search command? I tried &gt; which didn't work. (I also want to use this search text in "transaction startswith=" command so I cannot use `AND` condition) ... View more
Labels

Why doesn't "Wrap results" fit to the screen (or i...

by in Splunk Search
‎12-23-2022 11:01 AM
1 Karma
‎12-23-2022 11:01 AM
1 Karma
After I perform a search and click the "Format" Icon above the search results, there is an option for "Wrap Results". I check this and it does an attempt at wrapping results, but I still have to scroll incredibly far to the right to see each result. It seems to just pick some arbitrary length and wraps it there. I should note, in the events there are plenty of spaces that could be used as clean wrap points but the system just seems to not use them. Is there some sort of config setting that controls wrap behaviour that I could tweak? Here is the event: {"cf_app_id":"uuid","cf_app_name":"app-name","deployment":"cf","event_type":"LogMessage","info_splunk_index":"splunk-index","ip":"ipaddr","message_type":"OUT","msg":"2022-12-22 19:11:30.242 DEBUG [app-name,02c11142eee3be456dc30ddb1b234d5f,f20222ba46461ea9] 28 --- [nio-8080-exec-1] classname : {\"data\":{\"fields\":[{\"__typename\":\"name\",\"field\":\"value\",\"field2\":\"value2\",\"field3\":\"value 3\",\"field4\":\"value4\",\"field5\":\"value5\",\"field6\":\"value6\",\"field7\":\"value7\",\"field8\":null,\"field9\":\"value9\",\"field10\":null,\"field11\":111059.0,\"field12\":111059.0,\"field13\":null,\"field14\":\"value14\",\"field15\":\"2018-10-01\",\"field16\":null,\"field17\":false,\"field18\":{\"field19\":\"value19\",\"fieldl20\":\"value20\",\"field21\":2.6,\"field22\":\"2031-10-31\",\"field23\":\"2017-11-06\"},\"field24\":{\"field25\":\"\",\"field26\":\"\"},\"field27\":{\"field28\":{\"field29\":0.0,\"field30\":0.0,\"field31\":240.63,\"field32\":\"2022-12-31\",\"field33\":0.0,\"field34\":\"9999-10-31\"}},\"field35\":[{\"field36\":{\"field37\":\"value37\"}},{\"field38\":{\"field39\":\"value39\"}}],\"field40\":{\"__typename\":\"value40\",\"field41\":\"value41\",\"field42\":\"value 42\",\"field43\":111059.0,\"field44\":\"2031-04-01\",\"field45\":65204.67,\"field46\":null,\"field47\":\"value47\",\"field48\":\"value48\",\"field49\":null,\"field50\":\"value50\",\"field51\":null,\"field52\":null}},{\"__typename\":\"value53\",\"field54\":\"value54\",\"field55\":\"value55\",\"field56\":\"value56\",\"field57\":\"value57\",\"field58\":\"value58\",\"field59\":\"9\",\"field60\":\"value60\",\"field61\":null,\"field62\":\"value62\",\"field63\":null,\"field64\":88841.0,\"field65\":38841.0,\"field66\":null,\"field67\":\"value67\",\"field68\":\"2018-10-01\",\"field69\":null,\"field70\":false,\"field71\":{\"field72\":\"value72\",\"field73\":\"value73\",\"field74\":2.6,\"field75\":\"2031-10-31\",\"field76\":\"2017-11-06\"},\"field77\":{\"field78\":\"\",\"field79\":\"\"},\"field80\":{\"field81\":{\"field82\":0.0,\"field83\":0.0,\"field84\":84.16,\"field85\":\"2022-12-31\",\"field86\":0.0,\"field87\":\"9999-10-31\"}},\"field88\":[{\"field89\":{\"field90\":\"value90\"}},{\"field91\":{\"field92\":\"value92\"}}],\"field93\":null},{\"__typename\":\"value94\",\"field95\":\"value95\",\"field96\":\"value96\",\"field97\":\"value97\",\"field98\":\"value98\",\"field99\":\"value99\",\"field100\":\"1\",\"field101\":\"value101\",\"field102\":null,\"field103\":\"value103\",\"field104\":\"359\",\"field105\":88025.0,\"field106\":79316.87,\"field107\":\"309\",\"field108\":\"value108\",\"field109\":\"2018-10-01\",\"field110\":\"2048-09-30\",\"field111\":false,\"field112\":{\"field113\":\"value113\",\"field114\":\"value114\",\"field115\":2.35,\"field116\":\"2031-10-31\",\"field117\":\"2017-11-06\"},\"field118\":{\"field119\":\"\",\"field120\":\"\"},\"field121\":{\"field122\":{\"field123\":341.58,\"field124\":0.0,\"field125\":155.33,\"field126\":\"2022-12-31\",\"field127\":186.25,\"field128\":\"2022-12-31\"}},\"field129\":[{\"field130\":{\"field131\":\"value131\"}},{\"field132\":{\"field133\":\"value133\"}}],\"field134\":null}]}}","origin":"rep","source_instance":"0","source_type":"APP/PROC/WEB","timestamp":1671732690243306564} Here is a screenshot: wrap toggle is enabled wrap not working as you can see the horizontal scrolbar ... View more
Labels

Rendering of JSON data in Splunk Web

by in Splunk Search
‎12-23-2022 03:56 AM
‎12-23-2022 03:56 AM
Hi, I need the JSON array in Splunk `List` view to be expanded by default instead of showing the Plus icon. I have a Splunk event which is a JSON array: [{ "cf_app_id": "uuid", "cf_app_name": "app-name", "deployment": "cf", "event_type": "LogMessage", "info_splunk_index": "splunk-index", "ip": "ipaddr", "message_type": "OUT", "msg": "2022-12-22 19:11:30.242 DEBUG [app-name,02c11142eee3be456dc30ddb1b234d5f,f20222ba46461ea9] 28 --- [nio-8080-exec-1] classname : This is the start of the transaction", "origin": "rep", "source_instance": "0", "source_type": "APP/PROC/WEB", "timestamp": 1671732690242714069 }, { "cf_app_id": "uuid", "cf_app_name": "app-name", "deployment": "cf", "event_type": "LogMessage", "info_splunk_index": "splunk-index", "ip": "ipaddr", "message_type": "OUT", "msg": "2022-12-22 19:11:30.242 DEBUG [app-name,02c11142eee3be456dc30ddb1b234d5f,f20222ba46461ea9] 28 --- [nio-8080-exec-1] classname : app log text", "origin": "rep", "source_instance": "0", "source_type": "APP/PROC/WEB", "timestamp": 1671732690243292964 }, { "cf_app_id": "uuid", "cf_app_name": "app-name", "deployment": "cf", "event_type": "LogMessage", "info_splunk_index": "splunk-index", "ip": "ipaddr", "message_type": "OUT", "msg": "2022-12-22 19:11:30.242 DEBUG [app-name,02c11142eee3be456dc30ddb1b234d5f,f20222ba46461ea9] 28 --- [nio-8080-exec-1] classname : another app log", "origin": "rep", "source_instance": "0", "source_type": "APP/PROC/WEB", "timestamp": 1671732690243306564 }, { "cf_app_id": "uuid", "cf_app_name": "app-name", "deployment": "cf", "event_type": "LogMessage", "info_splunk_index": "splunk-index", "ip": "ipaddr", "message_type": "OUT", "msg": "2022-12-22 19:11:30.242 DEBUG [app-name,02c11142eee3be456dc30ddb1b234d5f,f20222ba46461ea9] 28 --- [nio-8080-exec-1] classname : {\"data\":{\"fields\":[{\"__typename\":\"name\",\"field\":\"value\",\"field2\":\"value2\",\"field3\":\"value 3\",\"field4\":\"value4\",\"field5\":\"value5\",\"field6\":\"value6\",\"field7\":\"value7\",\"field8\":null,\"field9\":\"value9\",\"field10\":null,\"field11\":111059.0,\"field12\":111059.0,\"field13\":null,\"field14\":\"value14\",\"field15\":\"2018-10-01\",\"field16\":null,\"field17\":false,\"field18\":{\"field19\":\"value19\",\"fieldl20\":\"value20\",\"field21\":2.6,\"field22\":\"2031-10-31\",\"field23\":\"2017-11-06\"},\"field24\":{\"field25\":\"\",\"field26\":\"\"},\"field27\":{\"field28\":{\"field29\":0.0,\"field30\":0.0,\"field31\":240.63,\"field32\":\"2022-12-31\",\"field33\":0.0,\"field34\":\"9999-10-31\"}},\"field35\":[{\"field36\":{\"field37\":\"value37\"}},{\"field38\":{\"field39\":\"value39\"}}],\"field40\":{\"__typename\":\"value40\",\"field41\":\"value41\",\"field42\":\"value 42\",\"field43\":111059.0,\"field44\":\"2031-04-01\",\"field45\":65204.67,\"field46\":null,\"field47\":\"value47\",\"field48\":\"value48\",\"field49\":null,\"field50\":\"value50\",\"field51\":null,\"field52\":null}},{\"__typename\":\"value53\",\"field54\":\"value54\",\"field55\":\"value55\",\"field56\":\"value56\",\"field57\":\"value57\",\"field58\":\"value58\",\"field59\":\"9\",\"field60\":\"value60\",\"field61\":null,\"field62\":\"value62\",\"field63\":null,\"field64\":88841.0,\"field65\":38841.0,\"field66\":null,\"field67\":\"value67\",\"field68\":\"2018-10-01\",\"field69\":null,\"field70\":false,\"field71\":{\"field72\":\"value72\",\"field73\":\"value73\",\"field74\":2.6,\"field75\":\"2031-10-31\",\"field76\":\"2017-11-06\"},\"field77\":{\"field78\":\"\",\"field79\":\"\"},\"field80\":{\"field81\":{\"field82\":0.0,\"field83\":0.0,\"field84\":84.16,\"field85\":\"2022-12-31\",\"field86\":0.0,\"field87\":\"9999-10-31\"}},\"field88\":[{\"field89\":{\"field90\":\"value90\"}},{\"field91\":{\"field92\":\"value92\"}}],\"field93\":null},{\"__typename\":\"value94\",\"field95\":\"value95\",\"field96\":\"value96\",\"field97\":\"value97\",\"field98\":\"value98\",\"field99\":\"value99\",\"field100\":\"1\",\"field101\":\"value101\",\"field102\":null,\"field103\":\"value103\",\"field104\":\"359\",\"field105\":88025.0,\"field106\":79316.87,\"field107\":\"309\",\"field108\":\"value108\",\"field109\":\"2018-10-01\",\"field110\":\"2048-09-30\",\"field111\":false,\"field112\":{\"field113\":\"value113\",\"field114\":\"value114\",\"field115\":2.35,\"field116\":\"2031-10-31\",\"field117\":\"2017-11-06\"},\"field118\":{\"field119\":\"\",\"field120\":\"\"},\"field121\":{\"field122\":{\"field123\":341.58,\"field124\":0.0,\"field125\":155.33,\"field126\":\"2022-12-31\",\"field127\":186.25,\"field128\":\"2022-12-31\"}},\"field129\":[{\"field130\":{\"field131\":\"value131\"}},{\"field132\":{\"field133\":\"value133\"}}],\"field134\":null}]}}", "origin": "rep", "source_instance": "0", "source_type": "APP/PROC/WEB", "timestamp": 1671732690243306564 }, { "cf_app_id": "uuid", "cf_app_name": "app-name", "deployment": "cf", "event_type": "LogMessage", "info_splunk_index": "splunk-index", "ip": "ipaddr", "message_type": "OUT", "msg": "2022-12-22 19:11:30.242 DEBUG [app-name,02c11142eee3be456dc30ddb1b234d5f,f20222ba46461ea9] 28 --- [nio-8080-exec-1] classname : This is the end of the transaction", "origin": "rep", "source_instance": "0", "source_type": "APP/PROC/WEB", "timestamp": 1671732690870483226 } ] When I open this in Splunk website in List view then I had to manually click on `plus` icon to expand each JSON in the Splunk event. Is there an option to make them expanded by default so that I can click on `minus` sign to minimise it if I want to   ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎01-11-2023 02:35 PM
Karma from
View All
Karma given to
View All