Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About MrIncredible
MrIncredible
Explorer
Member since:
01-02-2023
09-19-2024
Community Statistics
| Posts | 19 |
| Solutions | 0 |
| Karma Given | 4 |
| Karma Received | 0 |
| Member Since | 01-02-2023 |
Activity Feed
- Posted Re: federated search in splunk on Splunk Search. 09-19-2024 07:21 AM
- Posted federated search in splunk on Splunk Search. 09-18-2024 12:17 AM
- Karma Re: How to calculate number of days between two dates for a list of dates? for scelikok. 08-22-2023 03:42 AM
- Karma Re: How to calculate number of days between two dates for a list of dates? for yuanliu. 08-22-2023 03:42 AM
- Posted Re: How to calculate number of days between two dates for a list of dates? on Splunk Search. 08-22-2023 03:40 AM
- Posted Re: How to calculate number of days between two dates for a list of dates? on Splunk Search. 08-21-2023 05:38 AM
- Posted How to calculate number of days between two dates for a list of dates? on Splunk Search. 08-21-2023 05:02 AM
- Posted Is it possible to print dashboard result in mail body instead of a pdf attachment? on Splunk Enterprise. 05-03-2023 09:46 PM
- Posted Re: how to remove ( \" ) characters from search on Splunk Search. 01-10-2023 01:08 AM
- Posted Re: how to remove ( \" ) characters from search on Splunk Search. 01-09-2023 11:52 PM
- Posted How to remove ( \" ) characters from search? on Splunk Search. 01-09-2023 10:58 PM
- Posted Re: how to format results getting from multiple append on Splunk Search. 01-06-2023 05:19 AM
- Karma Re: how to format results getting from multiple append for PickleRick. 01-06-2023 05:18 AM
- Posted Re: how to format results getting from multiple append on Splunk Search. 01-06-2023 04:15 AM
- Posted Re: combine two queries on Getting Data In. 01-06-2023 03:16 AM
- Posted How to format results getting from multiple append? on Splunk Search. 01-06-2023 03:15 AM
- Posted Re: combine two queries on Getting Data In. 01-05-2023 11:43 PM
- Posted Re: combine two queries on Getting Data In. 01-05-2023 06:43 AM
- Posted Re: Need Help with Regex on Splunk Search. 01-03-2023 01:14 AM
- Karma Re: Need Help with Regex for gcusello. 01-03-2023 01:14 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-19-2024
07:21 AM
Thanks @PaulPanther for replying. can you please let me know if I can check this at user end whether custom fields are present on local and remote searchHeads or I need to take help from our infra team who manages Splunk. Because as far i can see these custom fields are saved in app where i am running search.
... View more
09-18-2024
12:17 AM
I am unable to search my custom fields in Splunk after getting migrated index from normal to federated. do I have to change something in field extractions? or something wrong in migration
... View more
Labels
- Labels:
-
field extraction
-
regex
08-22-2023
03:40 AM
thank @yuanliu its working. got to know new "json" functions. thanks for that.
... View more
08-21-2023
05:38 AM
Thanks a lot @scelikok for letting me know about "mvexpand", its really helpful. I am sorry earlier I forgot to mention one more field "certname" in this table. if I am adding this field now in this table, its showing 1 set of results for 1 date. Please help how to add certname field in this table?
... View more
08-21-2023
05:02 AM
Hello Community, I am trying to calculate number of days (difference) between today's date and a list of dates but getting desired result only for 1 record out of list of records (different dates). Can anyone help here please?Following query I am using: index="cds_prod_app" sourcetype=httpevent source="lambda:dip-prod-certs-validity-Splunk" | eval today=strftime(now(), "%d-%m-%Y") | eval todaydate=strptime(today, "%d-%m-%Y") | eval t1 = mvindex(expiry,0) | eval expirydate=strptime(t1, "%d-%m-%Y") | eval diff = round((expirydate - todaydate)/86400) | table expiry, today, diff ***Attaching screenshot ~TIA
... View more
05-03-2023
09:46 PM
When we "Schedule a pdf delivery" Is it possible to print dashboard result in Mail Body instead of a pdf attachment?
... View more
Labels
- Labels:
-
splunk-assist
-
using Splunk Enterprise
01-10-2023
01:08 AM
@gcusello error: and if i did some changes (marked in yellow) in regex, not getting error but also not getting desired result:
... View more
01-09-2023
11:52 PM
@gcuselloThanks for your reply. Its not throwing error now though not extracting eligibiltyStatus field as well.
... View more
01-09-2023
10:58 PM
In few logs I can see escape character is also printed. My rex is working fine when i am testing it on regex101.com but when i use the same in Splunk Search, its throwing error. I tried different combination by putting quotes but then different error comes.
Regex: https://regex101.com/r/Nm32kd/2
Splunk error:
... View more
Labels
- Labels:
-
field extraction
-
regex
-
rex
01-06-2023
05:19 AM
Thanks very much @PickleRick for explanation.
... View more
01-06-2023
04:15 AM
Thanks @PickleRick its working but do you mind if I ask you to explain this part a bit "stats values(*) as *" specially (*) as *. 🙂 TIA
... View more
01-06-2023
03:16 AM
@gcusello apologies!!! another question raised. https://community.splunk.com/t5/Getting-Data-In/how-to-format-results-getting-from-multiple-append/m-p/626144#M107583
... View more
01-06-2023
03:15 AM
Query:
index="web_app" (application= "abc-dxn-message-api" AND tracepoint= "START") (facility="d55075aaedc86d6577676605c0b5f3c0" OR "XYZ") | stats count as Input |append [search (application= "hum-message-api" AND tracepoint= "END") (facility="d55075aaedc86d6577676605c0b5f3c0" OR "XYZ") | stats count as Processed] |append [search (facility="d55075aaedc86d6577676605c0b5f3c0" OR "XYZ") "ERROR" | stats count as Error] | transpose column_name="Bundle"
Current Result: 4 columns * 3 rows
Expected Result: 2 columns * 3 rows
Bundle Count
Input x
Error x
Processed x
... View more
Labels
- Labels:
-
field extraction
01-05-2023
11:43 PM
Thanks @gcusello append is working more than 1 time also. My results are appearing as per attached screenshot (3 rows * 3 columns). I tried transpose command to make this in good format but somehow not able to remove last 2 columns. I mean what I am looking for, values should be shown like 3 rows & 2 columns. Is it possible with transpose command? can you help please
... View more
01-05-2023
06:43 AM
@gcusello @PickleRick And say if there are 3 or more queries to combine the results ... append will work ?
... View more
01-03-2023
01:14 AM
Many thanks @gcusello for your quick reply. 2nd option will work as in 1st option i don't want to restrict it with particular postfix.
... View more
01-02-2023
10:32 PM
I have a field "facilityAlias" for which location can be changed in every api log file. I have to extract that field using Regex method. I have tried Regex statement but not getting expected result.
Regex statement: rex field=_raw "facilityAlias\":\"(?<facility>.*)\"," expected result: Parc de Salut Mar Barcelona current result: Parc de Salut Mar Barcelona","systemName":"CMPSB
Sample Log file:
sample log: 2023-01-02 23:36:58,521 [[MuleRuntime].uber.3869: [abcd-message-kdhskhdsk-api].Delete_msg_from_queue.BLOCKING @27fe0275] INFO com.skdhksh.jsdhjshd.hsd.logging.internal.CustomLoggerOperations - {"environment":"stag36rcf_eu-env","applicationName":"abcd-message-kdhskhdsk-api","correlationId":"kshddhks-3o4u-jshd8-aksdbkadkahd","apiProcessingTime":347,"totalProcessingTime":740,"tracePoint":"END","logMessage":"{\n \"url\": \"abcd\",\n \"bucketName\": \"dipeus-data-store\",\n \"s3versionID\": \"shdkshdkshdkshdkshdkshdkjshd\",\n \"s3key\": \"ljdljdlajldj]dsdsd\ksdjksjdksjdksjdksjksjd\ksdjksjd\"\n}","txnMetadata":{"bundleId":"ahsdkhsdh-skjdhshdkshd-skdhshdks-skdhkshd","messageType":"abcd","messageSubType":"kdshdkshdks","facilityAlias":"Parc de Salut Mar Barcelona","systemName":"CMPSB","transactionStartTime":1672702617781,"relatesToPatientMerge":false,"inputPayload":"adhkjshdkshdkshdkshd"},"apiStartTime":"1672702618174"}
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-19-2024
10:45 AM
|
