cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
shashankk
Communicator
Member since: ‎06-22-2023
‎06-18-2024
Community Statistics
Posts 46
Solutions 0
Karma Given 31
Karma Received 0
Member Since ‎06-22-2023
Activity Feed
Topics I've Started
View All

Re: How to Join two queries

by in Splunk Search
‎06-17-2024 05:24 AM
‎06-17-2024 05:24 AM
Hi @P_vandereerden  Yes, as per the log pattern there are distinct transaction id's with the ORA-00001 error message. Requirement is to identify all such transactions with the error message. Please suggest. ... View more

How to Join two queries

by in Splunk Search
‎06-14-2024 08:27 AM
‎06-14-2024 08:27 AM
Hello Team, I need assistance with joining 2 SPL queries to get the desired output. Refer the below log snippet: As per the log pattern there are distinct transaction id's with the ORA-00001 error message. Requirement is to identify all such transactions with the error message. Please suggest.   240614 04:35:50 Algorithm: Al10: <=== Recv'd TRN: 48493009394940303 (TQ_HOST -> TQ_HOST) 240614 04:35:52 Algorithm: TS8398 hs_handle_base_rqst_msg: Error Executing CompareRBSrules Procedure. 240614 04:35:52 Algorithm: TS8398 hs_handle_base_rqst_msg: Details of ABC error ReSubResult:-1,FinalStatus:H,ErrorCode:-1,chLogMsg:SQL CODE IS -1 AND SQLERRM IS ORA-00001: unique constraint (INSTANCE.IDX_TS_UAT_ABC_ROW_ID) violated,LogDiscription:   I have below 2 queries with their respective output:   Query 1: index=test_index source=/test/instance ("<=== Recv'd TRN:") | rex field=_raw "\<=== Recv'd TRN:\s+(?<transaction_id>\w+)" | table _time transaction_id Output as: _time | transaction_id Query 2: index=test_index source=/test/instance ("ORA-00001") | table _time _raw Output as: _time | _raw   I want to merge or join both the results and get the final output as below: _time | transaction_id | _raw In this case (example) 240614 04:35:50 | 48493009394940303 | ORA-00001: unique constraint (INSTANCE.IDX_TS_UAT_ABC_ROW_ID) violated Please suggest what modifications to be done in the above query to get this desired result. @ITWhisperer - Kindly help. ... View more
Labels

Timezone issue in Splunk

by in Splunk Search
‎06-07-2024 06:21 AM
‎06-07-2024 06:21 AM
Hi Team, Need your assistance for the configuration changes in Splunk. The requirement is to change the Timezone based on different “source” (not sourcetype). We have different sources defined in our application. All of them are in their respective server timezone, except for the below 2 sources (these 2 are in EST timezone & our requirement is to change it into CET timezone)     source=/applications/testscan/*/testscn01/* source=/applications/testscan/*/testcpdom/*     For rest of the other sources, I do not want make any change in the Timezone. For example:     source=/applications/testscan/*/testscn02/* source=/applications/testscan/*/testnycus/* source=/applications/testscan/*/testnyus2/* source=/applications/testscan/*/testshape/* source=/applications/testscan/*/testshape2/* source=/applications/testscan/*/testshape3/*     Please note, we do not have any "props.conf" file available or configured in the server.  We are maintaining splunk configuration in only "inputs.conf" file. The present content of "inputs.conf" as below:     [monitor:///applications/testscan/.../] whitelist = (?:tools\/test\/log\/|TODAY\/LOGS\/)*\.(?:log|txt)$ index = testscan_prod sourcetype = testscan _TCP_ROUTING = in_prod [monitor:///applications/testscan/*/*/tools/test_transfer/log] index = testscan_prod sourcetype = testscan _TCP_ROUTING = in_prod [monitor:///applications/testscan/*/*/tools/test_reports/log] index = testscan_prod sourcetype = testscan _TCP_ROUTING = in_prod       Please suggest what changes to be done so that Timezone can be managed based on the "source" information provided. @ITWhisperer  ... View more

Re: Merge two logs to get the desired Dashboard

by in Splunk Search
‎04-19-2024 03:54 AM
‎04-19-2024 03:54 AM
@ITWhisperer - Refer the below comments inline: Are there lines where "AP sent to" or "AH sent to" or "MP sent to" exist in events without "---> TRN:" also being presents? -- No. "AP sent to" or "AH sent to" or "MP sent to" events always exist with "---> TRN:" Similarly, are there events where "---> TRN:" exists and one of "AP sent to" or "AH sent to" or "MP sent to" does not exists? -- No. "---> TRN:" events always exist with "AP sent to" or "AH sent to" or "MP sent to" Please can you explain the significance of the dropdown and how it determines which events are counted? > This dropdown is to make the Dashboard looks simpler. That is based on the Priority of Low, Medium or High will show the Transaction Pending volume.  Or in case, if you have other idea to handle the same - kindly suggest the same. ... View more

Re: Merge two logs to get the desired Dashboard

by in Splunk Search
‎04-18-2024 10:11 PM
‎04-18-2024 10:11 PM
Thank you for your kind response @ITWhisperer I have made the correction in the 2nd query: "<===" was referring from a different log event. Updated query:  source=/applications/test/*instance_xyz* ("<--- TRN:" OR "---> TRN:" OR "AP sent to" OR "AH sent to" OR "MP sent to") Refer below inline response to your question: The main issue with your request is that you haven't explained how the events are to be correlated between the two sources and how you would like to count them to give the desired result. Answer: There are basically 2 log files. "testget.log" using search criteria as "<--- TRN:" and Priority field information. "testput.log" using search criteria as "---> TRN:" OR "AP sent to" OR "AH sent to" OR "MP sent to" I need help to co-relate these 2 logs based on TRN. And final count I need to get it using TRN and TestMQ. Select: Low, Medium, High (From the Dashboard dropdown) Output Expected: TestMQ| Low-Testget | Low-Testput | Low-AP | Low-AH | Low-MP | Low-Pending TestMQ | Medium-Testget | Medium-Testput | Medium-AP | Medium-AH | Medium-MP | Medium-Pending TestMQ | High-Testget | High-Testput | High-AP | High-AH | High-MP | High-Pending Please suggest. ... View more

Re: Merge two logs to get the desired Dashboard

by in Splunk Search
‎04-18-2024 04:52 AM
‎04-18-2024 04:52 AM
@dtburrows3 @gcusello @PickleRick @ITWhisperer - Kindly help ... View more

Re: Merge two logs to get the desired Dashboard

by in Splunk Search
‎04-18-2024 04:10 AM
‎04-18-2024 04:10 AM
Sample "testput.log" file as below: 240418 06:44:53 3543 testput1: ---> TRN: 133c0119a15e407595cd46c89216ca101 - AP sent to [TEST.SND.TO.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:44:53 3543 testput1: <=== TRN@Al10: 133c0119a15e407595cd46c89216ca101 - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:44:52 3543 testput1: ---> TRN: b247073ae24443d79be3360de4c1bfec1 - AP sent to [TEST.SND.TO.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:44:52 3543 testput1: <=== TRN@Al5: b247073ae24443d79be3360de4c1bfec1 - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:44:52 3543 testput1: ---> TRN: f3cf7266d2ad4fa6bf86412441c374991 - AP sent to [TEST.SND.TO.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:44:52 3543 testput1: <=== TRN@Al10: f3cf7266d2ad4fa6bf86412441c374991 - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:44:52 3543 testput1: ---> TRN: d7de4351d94040a995eb373fe834a0371 - AP sent to [TEST.SND.TO.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:44:52 3543 testput1: <=== TRN@Al13: d7de4351d94040a995eb373fe834a0371 - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:44:50 3543 testput1: ---> TRN: c36d67d7af5f45f28afe0af2a80c6ea61 - AP sent to [TEST.SND.TO.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:44:50 3543 testput1: <=== TRN@Al9: c36d67d7af5f45f28afe0af2a80c6ea61 - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:43:31 3543 testput1: HS135255 InvokeIDRModule: << IDR TRN <UVW024041800194GN00002-DREn00001A> . Out Status = < > 240418 06:43:31 3543 testput1: HS135254 InvokeIDRModule: >> IDR TRN <UVW024041800194GN00002-DREn00001A> . In Status = <P> 240418 06:43:31 3543 testput1: ---> TRN: UVW024041800194GN00002-DREn00001A - MP sent to [TEST.SND.TO.PQR@QM.PQRS103]. 240418 06:43:31 3543 testput1: <=== TRN@mmicntl: UVW024041800194GN00002-DREn00001A - MP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:41:25 3543 testput1: ---> TRN: fbccac1e49bf41b9a66ac87c2e9976691 - AP sent to [TEST.SND.TO.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:41:25 3543 testput1: <=== TRN@Al9: fbccac1e49bf41b9a66ac87c2e9976691 - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:39:59 3543 testput1: ---> TRN: UVW024041800194GN00013 - MP sent to [TEST.SND.TO.PQR@QM.PQRS103]. 240418 06:39:59 3543 testput1: SendResponseToHost : Sending response to the Host 240418 06:39:59 3543 testput1: HS135255 InvokeIDRModule: << IDR TRN <UVW024041800194GN00013-DREn0000cA> . Out Status = <P> 240418 06:39:59 3543 testput1: HS135254 InvokeIDRModule: >> IDR TRN <UVW024041800194GN00013-DREn0000cA> . In Status = <H> 240418 06:39:59 3543 testput1: ---> TRN: UVW024041800194GN00013-DREn0000cA - AH sent to [TEST.SND.TO.PQR@QM.PQRS103]. 240418 06:39:59 3543 testput1: <=== TRN@Al9: UVW024041800194GN00013-DREn0000cA - AH. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:39:59 3543 testput1: ---> TRN: UVW024041800194GN00007-DREn00006A - AP sent to [TEST.SND.TO.PQR@QM.PQRS103]. 240418 06:39:59 3543 testput1: <=== TRN@Al7: UVW024041800194GN00007-DREn00006A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:39:59 3543 testput1: ---> TRN: UVW024041800194GN00010-DREn00009A - AP sent to [TEST.SND.TO.PQR@QM.PQRS103]. 240418 06:39:59 3543 testput1: <=== TRN@Al4: UVW024041800194GN00010-DREn00009A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:39:58 3543 testput1: ---> TRN: UVW024041800194GN00008-DREn00007A - AP sent to [TEST.SND.TO.PQR@QM.PQRS103]. 240418 06:39:58 3543 testput1: <=== TRN@Al3: UVW024041800194GN00008-DREn00007A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:39:58 3543 testput1: ---> TRN: UVW024041800194GN00006-DREn00005A - AP sent to [TEST.SND.TO.PQR@QM.PQRS103]. 240418 06:39:58 3543 testput1: <=== TRN@Al1: UVW024041800194GN00006-DREn00005A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:39:58 3543 testput1: ---> TRN: UVW024041800194GN00011-DREn0000aA - AP sent to [TEST.SND.TO.PQR@QM.PQRS103]. 240418 06:39:58 3543 testput1: <=== TRN@Al11: UVW024041800194GN00011-DREn0000aA - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:39:58 3543 testput1: HS135255 InvokeIDRModule: << IDR TRN <UVW024041800194GN00002-DREn00001A> . Out Status = <O> 240418 06:39:58 3543 testput1: HS135254 InvokeIDRModule: >> IDR TRN <UVW024041800194GN00002-DREn00001A> . In Status = <H> 240418 06:39:58 3543 testput1: ---> TRN: UVW024041800194GN00002-DREn00001A - AH sent to [TEST.SND.TO.PQR@QM.PQRS103]. 240418 06:39:58 3543 testput1: <=== TRN@Al10: UVW024041800194GN00002-DREn00001A - AH. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:39:58 3543 testput1: ---> TRN: UVW024041800194GN00012-DREn0000bA - AP sent to [TEST.SND.TO.PQR@QM.PQRS103]. 240418 06:39:58 3543 testput1: <=== TRN@Al8: UVW024041800194GN00012-DREn0000bA - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:39:58 3543 testput1: ---> TRN: UVW024041800194GN00003-DREn00002A - AP sent to [TEST.SND.TO.PQR@QM.PQRS103]. 240418 06:39:58 3543 testput1: <=== TRN@Al14: UVW024041800194GN00003-DREn00002A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:39:58 3543 testput1: ---> TRN: UVW024041800194GN00001 - MP sent to [TEST.SND.TO.PQR@QM.PQRS103]. 240418 06:39:58 3543 testput1: SendResponseToHost : Sending response to the Host 240418 06:39:58 3543 testput1: HS135255 InvokeIDRModule: << IDR TRN <UVW024041800194GN00001-DREn00000A> . Out Status = <P> 240418 06:39:58 3543 testput1: HS135254 InvokeIDRModule: >> IDR TRN <UVW024041800194GN00001-DREn00000A> . In Status = <H> 240418 06:39:58 3543 testput1: ---> TRN: UVW024041800194GN00001-DREn00000A - AH sent to [TEST.SND.TO.PQR@QM.PQRS103]. 240418 06:39:58 3543 testput1: <=== TRN@Al13: UVW024041800194GN00001-DREn00000A - AH. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:46 3543 testput1: <=== TRN@Al8: 34e4c77406e647d29859a7c3e0077cab1 - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:46 3543 testput1: ---> TRN: 34e4c77406e647d29859a7c3e0077cab1 - AP sent to [TEST.SND.TO.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:37:40 3543 testput1: HS135255 InvokeIDRModule: << IDR TRN <MNCDBC2024041804991213-DREg0000aA> . Out Status = < > 240418 06:37:40 3543 testput1: HS135254 InvokeIDRModule: >> IDR TRN <MNCDBC2024041804991213-DREg0000aA> . In Status = <P> 240418 06:37:40 3543 testput1: ---> TRN: MNCDBC2024041804991213-DREg0000aA - MP sent to [TEST.SND.TO.CPC@QM.PQRS103]. 240418 06:37:40 3543 testput1: <=== TRN@mmicntl: MNCDBC2024041804991213-DREg0000aA - MP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:28 3543 testput1: ---> TRN: 17bd221de8f14fd09439fc2bb9564bed1 - AP sent to [TEST.SND.TO.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:37:28 3543 testput1: <=== TRN@Al9: 17bd221de8f14fd09439fc2bb9564bed1 - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:23 3543 testput1: <=== TRN@mmicntl: CLG024041800098GN00001-DREh00023A - MP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:23 3543 testput1: HS135255 InvokeIDRModule: << IDR TRN <CLG024041800098GN00001-DREh00023A> . Out Status = < > 240418 06:37:23 3543 testput1: HS135254 InvokeIDRModule: >> IDR TRN <CLG024041800098GN00001-DREh00023A> . In Status = <P> 240418 06:37:23 3543 testput1: ---> TRN: CLG024041800098GN00001-DREh00023A - MP sent to [TEST.SND.TO.CLH@QM.PQRS103]. 240418 06:37:17 3543 testput1: ---> TRN: MNO24041800065GS00077-DREl0004cA - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:17 3543 testput1: <=== TRN@Al2: MNO24041800065GS00077-DREl0004cA - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:17 3543 testput1: ---> TRN: MNO24041800065GS00079-DREl0004eA - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:17 3543 testput1: <=== TRN@Al5: MNO24041800065GS00079-DREl0004eA - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:16 3543 testput1: ---> TRN: MNO24041800065GS00081-DREl00050A - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:16 3543 testput1: <=== TRN@Al1: MNO24041800065GS00081-DREl00050A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:16 3543 testput1: ---> TRN: MNO24041800065GS00075-DREl0004aA - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:15 3543 testput1: <=== TRN@Al1: MNO24041800065GS00064-DREl0003fA - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:15 3543 testput1: ---> TRN: MNO24041800065GS00063-DREl0003eA - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:15 3543 testput1: <=== TRN@Al13: MNO24041800065GS00063-DREl0003eA - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:15 3543 testput1: ---> TRN: MNO24041800065GS00066-DREl00041A - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:15 3543 testput1: <=== TRN@Al3: MNO24041800065GS00066-DREl00041A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:15 3543 testput1: ---> TRN: MNO24041800065GS00058-DREl00039A - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:15 3543 testput1: <=== TRN@Al2: MNO24041800065GS00058-DREl00039A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:15 3543 testput1: ---> TRN: MNO24041800065GS00061-DREl0003cA - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:15 3543 testput1: <=== TRN@Al12: MNO24041800065GS00061-DREl0003cA - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:12 3543 testput1: <=== TRN@Al4: MNO24041800065GS00035-DREl00022A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:12 3543 testput1: ---> TRN: MNO24041800065GS00033-DREl00020A - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:12 3543 testput1: <=== TRN@Al5: MNO24041800065GS00033-DREl00020A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:12 3543 testput1: ---> TRN: MNO24041800065GS00039-DREl00026A - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:12 3543 testput1: <=== TRN@Al3: MNO24041800065GS00039-DREl00026A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:12 3543 testput1: ---> TRN: MNO24041800065GS00044-DREl0002bA - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:12 3543 testput1: <=== TRN@Al14: MNO24041800065GS00044-DREl0002bA - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:12 3543 testput1: ---> TRN: MNO24041800065GS00038-DREl00025A - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:12 3543 testput1: <=== TRN@Al1: MNO24041800065GS00038-DREl00025A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:12 3543 testput1: ---> TRN: MNO24041800065GS00036-DREl00023A - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:11 3543 testput1: <=== TRN@Al9: MNO24041800065GS00026-DREl00019A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:11 3543 testput1: ---> TRN: MNO24041800065GS00019-DREl00012A - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:11 3543 testput1: <=== TRN@Al1: MNO24041800065GS00019-DREl00012A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:11 3543 testput1: ---> TRN: MNO24041800065GS00025-DREl00018A - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:11 3543 testput1: <=== TRN@Al5: MNO24041800065GS00025-DREl00018A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:11 3543 testput1: ---> TRN: MNO24041800065GS00016-DREl0000fA - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:11 3543 testput1: <=== TRN@Al4: MNO24041800065GS00016-DREl0000fA - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:11 3543 testput1: vlog: Current log size is 3497994 bytes 240418 06:37:11 3543 testput1: ---> TRN: MNO24041800065GS00024-DREl00017A - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:11 3543 testput1: <=== TRN@Al3: MNO24041800065GS00024-DREl00017A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:11 3543 testput1: ---> TRN: MNO24041800065GS00017-DREl00010A - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:11 3543 testput1: <=== TRN@Al12: MNO24041800065GS00017-DREl00010A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:11 3543 testput1: ---> TRN: MNO24041800065GS00022-DREl00015A - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:11 3543 testput1: <=== TRN@Al13: MNO24041800065GS00022-DREl00015A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:11 3543 testput1: ---> TRN: MNO24041800065GS00023 - MP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:11 3543 testput1: SendResponseToHost : Sending response to the Host 240418 06:37:11 3543 testput1: HS135255 InvokeIDRModule: << IDR TRN <MNO24041800065GS00023-DREl00016A> . Out Status = <P> 240418 06:37:11 3543 testput1: HS135254 InvokeIDRModule: >> IDR TRN <MNO24041800065GS00023-DREl00016A> . In Status = <H> 240418 06:37:11 3543 testput1: ---> TRN: MNO24041800065GS00023-DREl00016A - AH sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:11 3543 testput1: <=== TRN@Al10: MNO24041800065GS00023-DREl00016A - AH. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:09 3543 testput1: ---> TRN: MNO24041800065GS00007-DREl00006A - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:09 3543 testput1: <=== TRN@Al14: MNO24041800065GS00007-DREl00006A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:09 3543 testput1: ---> TRN: MNO24041800065GS00004-DREl00003A - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:37:09 3543 testput1: <=== TRN@Al8: MNO24041800065GS00004-DREl00003A - AP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1. 240418 06:37:09 3543 testput1: ---> TRN: MNO24041800065GS00001-DREl00000A - AP sent to [TEST.SND.TO.XYZ@QM.PQRS103]. 240418 06:35:10 3543 testput1: HS135255 InvokeIDRModule: << IDR TRN <UVW024041800193GN00003-DREh0002dA> . Out Status = < > 240418 06:35:10 3543 testput1: HS135254 InvokeIDRModule: >> IDR TRN <UVW024041800193GN00003-DREh0002dA> . In Status = <P> 240418 06:35:10 3543 testput1: ---> TRN: UVW024041800193GN00003-DREh0002dA - MP sent to [TEST.SND.TO.PQR@QM.PQRS103]. 240418 06:35:10 3543 testput1: <=== TRN@mmicntl: UVW024041800193GN00003-DREh0002dA - MP. DestHost=[MQ] from RESPONSE_Q1=instance_abc.RS1.   ... View more

Re: Merge two logs to get the desired Dashboard

by in Splunk Search
‎04-18-2024 04:08 AM
‎04-18-2024 04:08 AM
Refer below sample log file - there are 2 log files "testget.log" & "testput.log" Sample "testget.log" file as below: 240418 06:44:51 37787 testget1: ===> TRN@instance_abc.RQ1: 133c0119a15e407595cd46c89216ca101 [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:44:51 37787 testget1: <--- TRN: 133c0119a15e407595cd46c89216ca101 - S from [TEST.RCV.FROM.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:44:51 37787 testget1: ===> TRN@instance_abc.RQ1: b247073ae24443d79be3360de4c1bfec1 [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:44:51 37787 testget1: ===> TRN@instance_abc.RQ1: f3cf7266d2ad4fa6bf86412441c374991 [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:44:51 37787 testget1: <--- TRN: b247073ae24443d79be3360de4c1bfec1 - S from [TEST.RCV.FROM.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:44:51 37787 testget1: <--- TRN: f3cf7266d2ad4fa6bf86412441c374991 - S from [TEST.RCV.FROM.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:44:51 37787 testget1: ===> TRN@instance_abc.RQ1: d7de4351d94040a995eb373fe834a0371 [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:44:50 37787 testget1: <--- TRN: d7de4351d94040a995eb373fe834a0371 - S from [TEST.RCV.FROM.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:44:49 37787 testget1: ===> TRN@instance_abc.RQ1: c36d67d7af5f45f28afe0af2a80c6ea61 [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:44:49 37787 testget1: <--- TRN: c36d67d7af5f45f28afe0af2a80c6ea61 - S from [TEST.RCV.FROM.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:41:24 37787 testget1: ===> TRN@instance_abc.RQ1: fbccac1e49bf41b9a66ac87c2e9976691 [Priority=Medium,ScanPriority=4, Rule: LOC=HK2; Cur=USD; Amt≥0; Srv=ALL; Recv@1565936557:00 00-00-0000]. 240418 06:41:24 37787 testget1: <--- TRN: fbccac1e49bf41b9a66ac87c2e9976691 - S from [TEST.RCV.FROM.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:39:57 37787 testget1: ===> TRN@instance_abc.RQ1: UVW024041800194GN00013-DREn0000cA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:39:57 37787 testget1: ===> TRN@instance_abc.RQ1: UVW024041800194GN00012-DREn0000bA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:39:57 37787 testget1: ===> TRN@instance_abc.RQ1: UVW024041800194GN00011-DREn0000aA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:39:57 37787 testget1: ===> TRN@instance_abc.RQ1: UVW024041800194GN00010-DREn00009A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:39:57 37787 testget1: ===> TRN@instance_abc.RQ1: UVW024041800194GN00009-DREn00008A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:39:57 37787 testget1: ===> TRN@instance_abc.RQ1: UVW024041800194GN00008-DREn00007A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:39:57 37787 testget1: ===> TRN@instance_abc.RQ1: UVW024041800194GN00007-DREn00006A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:39:57 37787 testget1: ===> TRN@instance_abc.RQ1: UVW024041800194GN00006-DREn00005A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:39:57 37787 testget1: ===> TRN@instance_abc.RQ1: UVW024041800194GN00005-DREn00004A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:39:57 37787 testget1: ===> TRN@instance_abc.RQ1: UVW024041800194GN00004-DREn00003A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:39:57 37787 testget1: ===> TRN@instance_abc.RQ1: UVW024041800194GN00003-DREn00002A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:39:57 37787 testget1: ===> TRN@instance_abc.RQ1: UVW024041800194GN00002-DREn00001A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:39:57 37787 testget1: <--- TRN: UVW024041800194GN00013-DREn0000cA - S from [TEST.RCV.FROM.PQR@QM.PQRS103]. 240418 06:39:57 37787 testget1: <--- TRN: UVW024041800194GN00012-DREn0000bA - S from [TEST.RCV.FROM.PQR@QM.PQRS103]. 240418 06:39:57 37787 testget1: <--- TRN: UVW024041800194GN00011-DREn0000aA - S from [TEST.RCV.FROM.PQR@QM.PQRS103]. 240418 06:39:57 37787 testget1: <--- TRN: UVW024041800194GN00010-DREn00009A - S from [TEST.RCV.FROM.PQR@QM.PQRS103]. 240418 06:39:57 37787 testget1: <--- TRN: UVW024041800194GN00009-DREn00008A - S from [TEST.RCV.FROM.PQR@QM.PQRS103]. 240418 06:39:57 37787 testget1: <--- TRN: UVW024041800194GN00008-DREn00007A - S from [TEST.RCV.FROM.PQR@QM.PQRS103]. 240418 06:39:57 37787 testget1: <--- TRN: UVW024041800194GN00007-DREn00006A - S from [TEST.RCV.FROM.PQR@QM.PQRS103]. 240418 06:39:57 37787 testget1: vlog: Current log size is 2441342 bytes 240418 06:39:57 37787 testget1: <--- TRN: UVW024041800194GN00006-DREn00005A - S from [TEST.RCV.FROM.PQR@QM.PQRS103]. 240418 06:39:57 37787 testget1: <--- TRN: UVW024041800194GN00005-DREn00004A - S from [TEST.RCV.FROM.PQR@QM.PQRS103]. 240418 06:39:57 37787 testget1: <--- TRN: UVW024041800194GN00004-DREn00003A - S from [TEST.RCV.FROM.PQR@QM.PQRS103]. 240418 06:39:57 37787 testget1: <--- TRN: UVW024041800194GN00003-DREn00002A - S from [TEST.RCV.FROM.PQR@QM.PQRS103]. 240418 06:39:57 37787 testget1: <--- TRN: UVW024041800194GN00002-DREn00001A - S from [TEST.RCV.FROM.PQR@QM.PQRS103]. 240418 06:39:56 37787 testget1: ===> TRN@instance_abc.RQ1: UVW024041800194GN00001-DREn00000A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:39:56 37787 testget1: <--- TRN: UVW024041800194GN00001-DREn00000A - S from [TEST.RCV.FROM.PQR@QM.PQRS103]. 240418 06:37:45 37787 testget1: ===> TRN@instance_abc.RQ1: 34e4c77406e647d29859a7c3e0077cab1 [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:45 37787 testget1: <--- TRN: 34e4c77406e647d29859a7c3e0077cab1 - S from [TEST.RCV.FROM.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:37:28 37787 testget1: ===> TRN@instance_abc.RQ1: 17bd221de8f14fd09439fc2bb9564bed1 [Priority=Medium,ScanPriority=4, Rule: LOC=HK2; Cur=USD; Amt≥0; Srv=ALL; Recv@1565936557:00 00-00-0000]. 240418 06:37:28 37787 testget1: <--- TRN: 17bd221de8f14fd09439fc2bb9564bed1 - S from [TEST.RCV.FROM.ABC.PQRST.Q1@QM.PQRS102]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00081-DREl00050A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00080-DREl0004fA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00079-DREl0004eA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00078-DREl0004dA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00077-DREl0004cA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00076-DREl0004bA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00059-DREl0003aA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00058-DREl00039A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00057-DREl00038A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00056-DREl00037A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00055-DREl00036A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00054-DREl00035A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00053-DREl00034A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00052-DREl00033A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00081-DREl00050A - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00080-DREl0004fA - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00079-DREl0004eA - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00078-DREl0004dA - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00077-DREl0004cA - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00076-DREl0004bA - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00071-DREl00046A - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00057-DREl00038A - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00056-DREl00037A - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00055-DREl00036A - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00054-DREl00035A - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00053-DREl00034A - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00052-DREl00033A - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00051-DREl00032A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00050-DREl00031A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00049-DREl00030A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00048-DREl0002fA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00047-DREl0002eA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00031-DREl0001eA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00030-DREl0001dA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00029-DREl0001cA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00028-DREl0001bA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00027-DREl0001aA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00026-DREl00019A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00025-DREl00018A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00024-DREl00017A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: vlog: Current log size is 2427949 bytes 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00023-DREl00016A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00022-DREl00015A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00021-DREl00014A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00020-DREl00013A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00009-DREl00008A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00008-DREl00007A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00007-DREl00006A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00006-DREl00005A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00005-DREl00004A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00004-DREl00003A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00003-DREl00002A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00002-DREl00001A [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00051-DREl00032A - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00050-DREl00031A - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00049-DREl00030A - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00048-DREl0002fA - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00047-DREl0002eA - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00046-DREl0002dA - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00045-DREl0002cA - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00044-DREl0002bA - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00043-DREl0002aA - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00042-DREl00029A - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00036-DREl00023A - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:08 37787 testget1: <--- TRN: MNO24041800065GS00035-DREl00022A - S from [TEST.RCV.FROM.XYZ@QM.PQRS103]. 240418 06:37:07 37787 testget1: ===> TRN@instance_abc.RQ1: MNO24041800065GS00001-DREl00000A [Priority=Low,ScanPriority=0, Rule: Default Rule].         ... View more

Merge two logs to get the desired Dashboard

by in Splunk Search
‎04-18-2024 04:04 AM
‎04-18-2024 04:04 AM
I need to create a dashboard panel merging two different search queries. I have below two queries: Kindly help on this request.   index=test_index source=/applications/test/*instance_abc* ("<--- TRN:" OR "Priority" OR "---> TRN:" OR "AP sent to" OR "AH sent to" OR "MP sent to") | rex field=_raw "Priority\=(?<Priority>[^\,]+)" | rex "(?:\={3}\>|\<\-{3})\s+TRN[^\:]*\:\s+(?<trn>[^\s]+)" | rex "TEST\.RCV\.FROM\.(?<TestMQ>.*)\@" | stats count(eval(Priority=="Low")) as Low, count(eval(Priority=="Medium")) as Medium, count(eval(Priority=="High")) as High, values(TestMQ) as TestMQ by trn | stats sum(Low) as Low, sum(Medium) as Medium, sum(High) as High by TestMQ | addtotals fieldname="TotalCount" | sort by TotalCount desc     This gives me output as below: TestMQ | Low | Medium | High | TotalCount The 2nd query is below:     index=test_index source=/applications/test/*instance_abc* ("<--- TRN:" OR "Priority" OR "---> TRN:" OR "AP sent to" OR "AH sent to" OR "MP sent to") | eval field=split(source,"/") | eval Instance=mvindex(field,4) | chart count(eval(searchmatch("from"))) as Testget count(eval(searchmatch("sent to"))) as Testput count(eval(searchmatch("AP sent to"))) as AP count(eval(searchmatch("AH sent to"))) as AH count(eval(searchmatch("MP sent to"))) as MP by Instance | eval Pending = Testget - (AP + AH) | sort Testget desc     This gives me output as below: Instance | Testget | Testput | AP | AH | MP | Pending I am looking for merging both the queries together and get the final output based on Pending volume for Low, Medium and High priority counts.   Select: Low, Medium, High (From the Dashboard dropdown) Output Expected: TestMQ| Low-Testget | Low-Testput | Low-AP | Low-AH | Low-MP | Low-Pending TestMQ | Medium-Testget | Medium-Testput | Medium-AP | Medium-AH | Medium-MP | Medium-Pending TestMQ | High-Testget | High-Testput | High-AP | High-AH | High-MP | High-Pending ... View more
Labels

Re: Splunk stats count group by multiple fields

by in Splunk Search
‎01-08-2024 04:41 AM
‎01-08-2024 04:41 AM
Hi @gcusello  I have added below more lines of the sample event file - please help me find the right key. Or if not possible with the correlation Key - how to proceed with the JOIN in this case? Kindly guide and suggest.   240108 07:12:07 17709 testget1: ===> TRN@instance2.RQ1: 0000002400840162931785-AHGM0000bA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240108 07:12:07 17709 testget1: <--- TRN: 0000002400840162929525-AHGM00015A - S from [RCV.FROM.TEST.SEP2.Q2@QM.ABCD101].     ... View more

Re: Splunk stats count group by multiple fields

by in Splunk Search
‎01-08-2024 03:49 AM
‎01-08-2024 03:49 AM
Hi @gcusello - Thank you for you continuos support. I am able to proceed next with your suggestion but now stuck at one point. Need your help on it.  Kindly suggest. Query Used:  index=test_index source=*instance*/*testget* | rex "\: (?<testgettrn>.*) \- S from" | rex "RCV\.FROM\.(?<TestMQ>.*)\@" | rex field=TestMQ "\w+\.\w+\.(?<key>\w+)" | rex "TRN\@\\w+\.R(?<key>[^:]++):" | rex "Priority\=(?<Priority>\w+)" | stats values(TestMQ) AS TestMQ count(eval(Priority="Low")) as Low, count(eval(Priority="Medium")) as Medium, count(eval(Priority="High")) as High BY key | fillnull value=0 | addtotals Getting results as below: Total count (Q1+Q2) is getting added to Q1 only. And Q2 is remaining null (as shown in below example) key | TestMQ | Low | Medium | High | Total Q1 | TEST.SEP.Q1 | 20 | 20 | 30 | 70 | TEST.SEP2.Q1 | TEST.SEP3.Q1 Q2 | TEST.SEP.Q2 | 0 | 0 | 0 | 0 | TEST.SEP2.Q2 | TEST.SEP3.Q2  Please guide and suggest. ... View more

Re: Splunk stats count group by multiple fields

by in Splunk Search
‎01-07-2024 11:48 PM
‎01-07-2024 11:48 PM
Hi @gcusello @ITWhisperer  In this case I can see the TransactionID is the common field between both the events (TestMQ and Priority) - but I am unable to find how to use the same in the query. Can you please help and suggest on it? Or can we do a JOIN based transaction id's (for both the event types - TestMQ & Priority)   | rex field=_raw "(?<TransactionID>\d+-\w+)"   ... View more

Re: Splunk stats count group by multiple fields

by in Splunk Search
‎01-05-2024 09:49 AM
‎01-05-2024 09:49 AM
Hi @gcusello  Refer below requested sample query and event details: Kindly suggest.   index=test_index=*instance*/*testget* | rex "\: (?<testgettrn>.*) \- S from" | rex "RCV\.FROM\.(?<TestMQ>.*)\@" | eval Priority_Level=case(Priority="Low", "Low", Priority="Medium", "Medium", Priority="High", "High") | stats count as TotalCount, count(eval(Priority_Level="Low")) as Low, count(eval(Priority_Level="Medium")) as Medium, count(eval(Priority_Level="High")) as High by TestMQ | fillnull value=0     Sample Events:   240105 18:06:03 19287 testget1: ===> TRN@instance.RQ1: 0000002400509150632034-AERG00001A [Priority=Low,ScanPriority=0, Rule: Default Rule]. host = testserver2.com source = /test/test.logsourcetype = testscan 240105 18:06:03 19287 testget1: ===> TRN@instance.RQ1: 0000002400540101635213-AERG00000A [Priority=Low,ScanPriority=0, Rule: Default Rule]. host = testserver2.com source = /test/test.log sourcetype = testscan 240105 18:06:03 19287 testget1: <--- TRN: 0000002481540150632034-AERG00001A - S from [RCV.FROM.TEST.SEP.Q1@QM.ABC123]. host = testserver2.com source = /test/test.log sourcetype = testscan 240105 18:06:03 19287 testget1: <--- TRN: 0000002400547150635213-AERG00000A - S from [RCV.FROM.TEST.SEP.Q1@QM.ABC123]. host = testserver2.com source = /test/test.log sourcetype = testscan 240105 18:02:29 72965 testget1: ===> TRN@instance.RQ1: 0000002400540902427245-AERC000f8A [Priority=Medium,ScanPriority=2, Rule: Default Rule]. host = testserver1.com source = /test/test.log sourcetype = testscan 240105 18:02:29 72965 testget1: ===> TRN@instance.RQ1: 0000001800540152427236-AERC000f7A [Priority=Medium,ScanPriority=2, Rule: Default Rule]. host = testserver1.com source = /test/test.log sourcetype = testscan 240105 18:02:29 72965 testget1: ===> TRN@instance.RQ1: 0000002400540109427216-AERC000f6A [Priority=High,ScanPriority=1, Rule: Default Rule]. host = testserver1.com source = /test/test.log sourcetype = testscan   ... View more

Re: Splunk stats count group by multiple fields

by in Splunk Search
‎01-05-2024 07:15 AM
‎01-05-2024 07:15 AM
Hello @PickleRick @gcusello @isoutamo - thanks for your kind response. I am reframing my problem statement here: Refer below Sample events from the logs:   240108 07:12:07 17709 testget1: ===> TRN@instance2.RQ1: 0000002400840162931785-AHGM0000bA [Priority=Low,ScanPriority=0, Rule: Default Rule]. 240108 07:12:07 17709 testget1: <--- TRN: 0000002400840162929525-AHGM00015A - S from [RCV.FROM.TEST.SEP2.Q2@QM.ABCD101].   I am having issues while fetching data from 2 stats (TestMQ and Priority_Level) count fields together. Below is the query:     index=test_index=*instance*/*testget* | rex "\: (?<testgettrn>.*) \- S from" | rex "RCV\.FROM\.(?<TestMQ>.*)\@" | eval Priority_Level=case(Priority="Low", "Low", Priority="Medium", "Medium", Priority="High", "High") | stats count as TotalCount, count(eval(Priority_Level="Low")) as Low, count(eval(Priority_Level="Medium")) as Medium, count(eval(Priority_Level="High")) as High by TestMQ | fillnull value=0     This gives me result like example below:     TestMQ | TotalCount | Low | Medium | High MQNam1 | 120 | 0 | 0 | 0 MQNam2 | 152 | 0 | 0 | 0 ..     The problem is that I am getting "0" value for Low, Medium & High columns - which is not correct. I want to combine both the stats and show the group by results of both the fields. If I run the same query with separate stats - it gives individual data correctly. Case 1: stats count as TotalCount by TestMQ     index=test_index=*instance*/*testget* | rex "\: (?<testgettrn>.*) \- S from" | rex "RCV\.FROM\.(?<TestMQ>.*)\@" | eval Priority_Level=case(Priority="Low", "Low", Priority="Medium", "Medium", Priority="High", "High") | stats count as TotalCount by TestMQ Example Output: TestMQ | TotalCount MQName | 201       Case 2: stats count as PriorityCount by Priority_Level     index=test_index=*instance*/*testget* | rex "\: (?<testgettrn>.*) \- S from" | rex "RCV\.FROM\.(?<TestMQ>.*)\@" | eval Priority_Level=case(Priority="Low", "Low", Priority="Medium", "Medium", Priority="High", "High") | stats count as PriorityCount by Priority_Level Example Output: Priority_Level | PriorityCount High | 20 Medium | 53 Low | 78     Please help and suggest. ... View more

Re: Splunk stats count group by multiple fields

by in Splunk Search
‎01-05-2024 07:09 AM
‎01-05-2024 07:09 AM
@isoutamo Thanks for your kind response. I tried with the suggested approach. But it doesn't give the expected result. index=Test | rex "(?<TestMQ>.*)\@" | eval Priority_Level=case(Priority="Low", "Low", Priority="Medium", "Medium", Priority="High", "High") | chart count BY TestMQ, Priority_Level | fillnull value=0 Getting output as: TestMQ | count Expected output: TestMQ | TotalCount | Low | Medium | High ... View more

Re: Splunk stats count group by multiple fields

by in Splunk Search
‎01-05-2024 05:54 AM
‎01-05-2024 05:54 AM
Hi @gcusello  Thank you for your kind response. I tried the suggested approach but the result is same. This gives me result like example below: TestMQ    | TotalCount | Low | Medium | High MQNam1 | 120               | 0       | 0               | 0 MQNam2 | 152               | 0       | 0               | 0 The problem is that I am getting "0" value for Low, Medium & High columns - which is not correct. I want to combine both the stats and show the group by results of both the fields. Please suggest. ... View more

Splunk stats count group by multiple fields

by in Splunk Search
‎01-05-2024 04:11 AM
‎01-05-2024 04:11 AM
Hi Splunk Team I am having issues while fetching data from 2 stats count fields together. Below is the query: index=test_index | rex "\.(?<TestMQ>.*)\@" | eval Priority_Level=case(Priority="Low", "Low", Priority="Medium", "Medium", Priority="High", "High") | stats count as TotalCount, count(eval(Priority_Level="Low")) as Low, count(eval(Priority_Level="Medium")) as Medium, count(eval(Priority_Level="High")) as High by TestMQ This gives me result like example below: TestMQ    | TotalCount | Low | Medium | High MQNam1 | 120               | 0       | 0               | 0 MQNam2 | 152               | 0       | 0               | 0 .. The problem is that I am getting "0" value for Low, Medium & High columns - which is not correct. I want to combine both the stats and show the group by results of both the fields. If I run the same query with separate stats - it gives individual data correctly. Case 1: stats count as TotalCount by TestMQ index=test_index | rex "\.(?<TestMQ>.*)\@" | eval Priority_Level=case(Priority="Low", "Low", Priority="Medium", "Medium", Priority="High", "High") | stats count as TotalCount by TestMQ Example Output: TestMQ     | TotalCount MQName  | 201 Case 2: stats count as PriorityCount by Priority_Level index=test_index | rex "\.(?<TestMQ>.*)\@" | eval Priority_Level=case(Priority="Low", "Low", Priority="Medium", "Medium", Priority="High", "High") | stats count as PriorityCount by Priority_Level Example Output:  Priority_Level | PriorityCount  High                    |  20 Medium             |  53 Low                     |  78 Please help and suggest. @ITWhisperer - kindly assist.  ... View more
Labels

Re: Splunk Query - how to get sum of count for a s...

by in Splunk Search
‎07-13-2023 02:30 AM
‎07-13-2023 02:30 AM
Thank you for kind your response @ITWhisperer  I have tried the suggested approach as below: index=<search_string> earliest=-30d@d | timechart span=1m aligntime=earliest count(eval(searchmatch("from"))) as HotCount by TestMQ | where tonumber(strftime(_time, "%H")) >= 2 AND tonumber(strftime(_time, "%H")) < 4 | eval Day=strftime(_time, "%Y-%m-%d") | addtotals fieldname=TotalHotCount label="Total" labelfield=TestMQ It gives me result in below format. It is doing the Row level of Sum.  Additionally I am looking for Merging the column results in Day wise total. (i.e. the total of the given time range should be added as a Day wise output) _time TestMQ1 TestMQ2 TestMQ3 Day TotalHotCount 2023-07-04 02:00:00 100 150 200 2023-07-04 450 2023-07-04 02:01:00 50 100 150 2023-07-04  300 2023-07-04 02:02:00 150 150 300 2023-07-04  600 and so on....for 30 days .. .. .. .. ..   Expected output as below, please suggest what is missing here and how it can be achieved? Kindly suggest. Day Wise TestMQ1 TestMQ2 TestMQ3 TotalHotCount 2023-07-04 120 180 200 500 2023-07-05  90 110 100 300 2023-07-06  150 100 120 370 and so on.... .. .. .. .. ... View more

Splunk Query - how to get sum of count for a speci...

by in Splunk Search
‎07-11-2023 10:30 AM
‎07-11-2023 10:30 AM
I am having a below query and the sample output shown: index=<search_string> earliest=-30d@d | timechart span=1m aligntime=earliest count(eval(searchmatch("from"))) as HotCount by TestMQ | where tonumber(strftime(_time, "%H")) >= 2 AND tonumber(strftime(_time, "%H")) < 4   _time TestMQ1 TestMQ2 TestMQ3 2023-07-04 02:00:00 20 30 45 2023-07-04 02:01:00 30 80 20 2023-07-04 02:02:00 50 20 25 and so on.... .. .. .. My requirement is to get the Sum of these HotCount and show it as TotalHotCount in a Day wise columns. I have tried modifying this query to get total sum and store the results in day wise column as below: index=<search_string> earliest=-30d@d | timechart span=1m aligntime=earliest count(eval(searchmatch("from"))) as HotCount by TestMQ | where tonumber(strftime(_time, "%H")) >= 2 AND tonumber(strftime(_time, "%H")) < 4 | eval Day=strftime(_time, "%Y-%m-%d") | stats sum(HotCount) as TotalHotCount by Day But, this is not giving me any results (blank output). What is missing here and how it can be modified to achieve the below expected results? Kindly suggest. Day TestMQ1 TestMQ2 TestMQ3 2023-07-04 120 170 210 2023-07-05  90 180 120 2023-07-06  150 120 125 and so on.... .. .. .. ... View more
Labels

Re: Splunk - how to modify Token based on the choi...

by in Dashboards & Visualizations
‎07-05-2023 02:33 AM
‎07-05-2023 02:33 AM
@ITWhisperer  Thank you for your great help! 🙂 This works fine now. The only modification which I did is below: Removed the below Submit button: <fieldset submitButton="true" autoRun="true"> And enabled searchWhenChanged="true" for below: <input type="dropdown" token="timefrom" searchWhenChanged="false"> <input type="dropdown" token="timeto" searchWhenChanged="false"> ... View more

Re: Splunk - how to modify Token based on the choi...

by in Dashboards & Visualizations
‎07-04-2023 10:35 AM
‎07-04-2023 10:35 AM
@ITWhisperer - Thank you for your kind response. Can you please help elaborate more as I could not understand it properly what you are trying to convey here? "best to add to both timeto and timefrom inputs rather than having another timespan input" How do I go about this? ... View more

Re: Splunk - how to modify Token based on the choi...

by in Dashboards & Visualizations
‎07-04-2023 08:55 AM
‎07-04-2023 08:55 AM
@ITWhisperer - I tried this suggested approach, but don't see any change in the TimeSpan field. The value is not getting populated in the Text box.  For Example: TimeFrom: 2 TimeTo: 4 TimeSpan = (4 -2)*60 = 120 I am getting below error: "Error in 'timechart' command: The value for option span (nullm) is invalid. When span is expressed using a sub-second unit (ds, cs, ms, us), the span value needs to be < 1 second, and 1 second must be evenly divisible by the span value." | timechart span=nullm aligntime=earliest count(eval(searchmatch("sent"))) as HotPutCount by HotScanMQ And there is no value getting set into the TimeSpan text box on the dashboard.  Refer below code snippet used: <fieldset submitButton="true" autoRun="true"> <input type="dropdown" token="instance" searchWhenChanged="true"> <label>Instance</label> <choice value="instance1">instance1</choice> <choice value="instance2">instance2</choice> <default>instance1</default> <initialValue>instance1</initialValue> </input> <input type="dropdown" token="timefrom" searchWhenChanged="false"> <label>Time Range From (24 Hour)</label> <choice value="01">01:00</choice> <! code omitted to make it shorted !> <choice value="24">24:00</choice> <default>02</default> <initialValue>02</initialValue> </input> <input type="dropdown" token="timeto" searchWhenChanged="false"> <label>Time Range To (24 Hour)</label> <choice value="01">01:00</choice> <! code omitted to make it shorted !> <choice value="24">24:00</choice> <default>04</default> <initialValue>04</initialValue> </input> <input type="text" token="TimeSpan"> <label>Interval (in mins)</label> <change> <eval token="TimeSpan">($timeto$ - $timefrom$) * 60</eval> </change> </input> </fieldset> ... View more

Re: Splunk - how to modify Token based on the choi...

by in Dashboards & Visualizations
‎07-04-2023 07:30 AM
‎07-04-2023 07:30 AM
@ITWhisperer  Your previous suggestion (timechart span=$TimeSpan$m) works fine if the User enters the token value manually. My requirement is to fetch the TimeSpan value dynamically on the basis of Time Range selection by the User. I hope it clarifies now. ... View more

Re: Splunk - how to modify Token based on the choi...

by in Dashboards & Visualizations
‎07-04-2023 07:04 AM
‎07-04-2023 07:04 AM
@ITWhisperer  This doesn't solve my problem. (| timechart span=$TimeSpan$m)  I want "timechart span" should be dynamically selected based on the User inputs for the Time Range (i.e. timeto and timefrom).  So given that timeto and timefrom are tokens, I want to set up another token when these tokens are set which equates to the value I want in TimeSpan. TimeSpan = ($timeto$ - $timefrom$) * 60 Note: Additionally, I want to keep TimeSpan field as hidden or disabled for any manual entry by the user. I hope it is clarified now, kindly suggest how this can be achieved? OR the 2nd option: Do we have any way to pass this value as variable/attribute to the "timechart span" in the query itself? I have tried out the below approach, but it doesn't work. | eval TimeSpan= ($timeto$ - $timefrom$) * 60 | timechart span=$TimeSpan$m aligntime=earliest count(eval(searchmatch("sent"))) as HotCount by TestMQ | where tonumber(strftime(_time, "%H")) >= $timefrom$ AND tonumber(strftime(_time, "%H")) <= $timeto$ ... View more

Re: Splunk - how to modify Token based on the choi...

by in Dashboards & Visualizations
‎07-04-2023 03:25 AM
‎07-04-2023 03:25 AM
@ITWhisperer - Thank you for your response! I tried the suggested approach, but don't see any change. My Dashboard is having 4 input fields: Instance | Time Range From (24 Hour) | Time Range To (24 Hour) | Interval (in mins) | Submit (button) Interval (in mins) is a Text box. Expected output is the TimeSpan token should write the below calculated value in this field. And it should be disabled for any manual user inputs. For Ex: TimeSpan = 120 Please suggest. Refer below code snippet: <fieldset submitButton="true" autoRun="true"> <input type="dropdown" token="instance" searchWhenChanged="true"> <label>Instance</label> <choice value="instance1">instance1</choice> <choice value="instance2">instance2</choice> <default>instance1</default> <initialValue>instance1</initialValue> </input> <input type="dropdown" token="timefrom" searchWhenChanged="false"> <label>Time Range From (24 Hour)</label> <choice value="01">01:00</choice> <! code omitted to make it shorted !> <choice value="24">24:00</choice> <default>02</default> <initialValue>02</initialValue> </input> <input type="dropdown" token="timeto" searchWhenChanged="false"> <label>Time Range To (24 Hour)</label> <choice value="01">01:00</choice> <! code omitted to make it shorted !> <choice value="24">24:00</choice> <default>04</default> <initialValue>04</initialValue> </input> <input type="text" token="TimeSpan"> <label>Interval (in mins)</label> <change> <eval token="TimeSpan">($timeto$ - $timefrom$) * 60</eval> </change> </input> </fieldset> ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-18-2024 10:03 AM
Karma given to