Activity Feed
- Posted Dashboard Studio Dropdown: Set multiple tokens or set single token but display different values on Dashboards & Visualizations. 01-10-2025 11:02 AM
- Tagged Dashboard Studio Dropdown: Set multiple tokens or set single token but display different values on Dashboards & Visualizations. 01-10-2025 11:02 AM
- Posted Re: Join two indexes on time where time is different by 2 sec on Splunk Search. 11-05-2024 06:41 AM
- Karma Re: Join two indexes on time where time is different by 2 sec for PickleRick. 11-05-2024 06:41 AM
- Karma Re: Join two indexes on time where time is different by 2 sec for MuS. 11-05-2024 06:41 AM
- Karma Re: Join two indexes on time where time is different by 2 sec for PickleRick. 11-05-2024 06:41 AM
- Karma Re: Join two indexes on time where time is different by 2 sec for MuS. 11-05-2024 06:41 AM
- Karma Re: Join two indexes on time where time is different by 2 sec for PickleRick. 11-05-2024 06:41 AM
- Posted Re: Join two indexes on time where time is different by 2 sec on Splunk Search. 11-05-2024 06:25 AM
- Posted Join two indexes on time where time is different by 2 sec on Splunk Search. 11-04-2024 12:20 PM
- Posted Drilldown Token from Single Value Panel to Stats Table Panel on Splunk Search. 10-21-2024 02:15 PM
- Karma Re: Using Eval Where Clause in Secondary Search from Stats Count for PickleRick. 10-21-2024 11:14 AM
- Posted Re: Using Eval Where Clause in Secondary Search from Stats Count on Splunk Search. 10-18-2024 11:39 AM
- Posted Using Eval Where Clause in Secondary Search from Stats Count on Splunk Search. 10-18-2024 11:10 AM
- Posted Re: Using Value from Rex Command in Interactive Drilldown Dashboard on Dashboards & Visualizations. 10-14-2024 12:39 PM
- Posted Re: Using Value from Rex Command in Interactive Drilldown Dashboard on Dashboards & Visualizations. 10-14-2024 12:16 PM
- Posted Re: Using Value from Rex Command in Interactive Drilldown Dashboard on Dashboards & Visualizations. 10-14-2024 12:07 PM
- Posted Re: Using Value from Rex Command in Interactive Drilldown Dashboard on Dashboards & Visualizations. 10-14-2024 11:58 AM
- Posted Using Value from Rex Command in Interactive Drilldown Dashboard on Dashboards & Visualizations. 10-14-2024 11:24 AM
- Posted Re: Printer Log search to list all printers from lookup and give record count and page printed count on Splunk Search. 10-10-2024 06:46 AM
Topics I've Started
Subject | Karma | Author | Latest Post |
---|---|---|---|
0 | |||
0 | |||
0 | |||
0 | |||
0 | |||
0 | |||
0 | |||
0 | |||
0 | |||
0 |
01-10-2025
11:02 AM
Working on a dashboard in dashboard studio to display data in two different tables using a single dropdown. Issue I have is that all my data is determined by the "username" field but want to have dropdown display user Lastname, Firstname for better visibility. First table pulls records from a lookup table with user demographics and such. Second table is pulling respective window log data tracking various user activity. In my dropdown, I am currently using the lookup table and eval function to join both "user_last", "user_first" set variable to "fullname" and display User "Lastname, Firstname". I then used "fullname" as the pass-on token for my first table. However, my second table, I need the "username" as the token because the data I am querying only has the "username" in the logs and not the users first or last name as my first table. My question is can I set my dropdown to display "user_last, user_first" names but set the token value as "username" or can I assign multiple tokens in a SPL query in Dashboard Studio to use in the respective tables or can I do both for sake of knowledge. Here is what I am working with and appreciate any assistance with this. Lookup table: Name: system_users.csv Fields: username, name_last, name_first....
Dashboard Dropdown Field Values: Data Source Name: lookup_users
SPL Query:
| inputlookup bpn_system_users.csv
| eval fullname= name_last.", ".name_first
| table fullname
| sort fullname
Source Code:
{
"type": "ds.search",
"options": {
"queryParameters": {
"earliest": "$SearchTimeLine.earliest$",
"latest": "$SearchTimeLine.latest$"
},
"query": " | inputlookup system_users.csv\n
| eval fullname= name_last.\", \".name_first\n
| table fullname\n
| sort fullname"
},
"name": "lookup_users"
}
... View more
Labels
- Labels:
-
Dashboard Studio
-
drilldown
-
token
11-05-2024
06:41 AM
Hey, Thanks again for giving me your insight on this one. I did come across the bin command but thought the transaction might be better to try in this situation. As I am still learning the power and uses of many of the commands that can be used in Splunk, this does help me get a better understanding of how to use and when to use the transaction command. As you pointed out and is my true problem in this case, there are only two common/semi common variables I have between my two indexes, that being "_time" and "username". I have compared the raw logs from both indexes and it appears that at most, the print jobs are separated by 2 secs and I haven't seen any print jobs by the same user that have been closer than 10 seconds apart. But as to your point, I will make note that there could be some issue with my output if a user prints two jobs seconds apart from each other. As always, appreciate your input and clarification on my questions.
... View more
11-05-2024
06:25 AM
MuS, Thanks for the response. I am going to take this and work with what I have. As I put this in my search, found out that my test data is different then what my _raw data actually is. The username field from printserver index is "username" but my username field from my printlogs is "User_Name" but has a domain name is front of it. index=prntserver _time, prnt_name username location 2024-11-04 11:05:32 Printer1 jon.doe Office 2024-11-04 12:20:56 Printer2 tim.allen FrontDesk I have an index getting data from our DLP software that contains the following data: index=printlogs _time Users_Name directory file 2024-11-04 11:05:33 cpn/jon.doe c:/desktop/prints/ document1.doc 2024-11-04 12:20:58 tim.allen c:/documents/files/ document2.xlsx I am going ot Rex the User_Name field from my print logs to match it with my printserver logs. This is what I am going to work with and see if I get the results I need. Thank you for your insight. index=printserver OR index=printlogs | rex field="User_Name" "(?<domain>\S)+\\\\(?<username>\S+)" | bin _time span=3s | stats values(*) AS * by _time username | table _time prnt_name username location directory file
... View more
11-04-2024
12:20 PM
Hello, I am trying to join two indexes to display data from our local printers. I have an index getting data from our printer server that contains the following data: index=prntserver _time, prnt_name username location 2024-11-04 11:05:32 Printer1 jon.doe Office 2024-11-04 12:20:56 Printer2 tim.allen FrontDesk I have an index getting data from our DLP software that contains the following data: index=printlogs _time usersname directory file 2024-11-04 11:05:33 jon.doe c:/desktop/prints/ document1.doc 2024-11-04 12:20:58 tim.allen c:/documents/files/ document2.xlsx I am trying to join the two indexes to give me time, printer name, user name and location from the Print Server Index and then give me directory and file name that was recorded from my Print Log Index. I am wanting to use time to join the two indexes but my issues is that the timestamp is off by 1 if not 2 seconds between the two index records. I was trying to use the transaction command with a maxspan=3s to be safe but cannot get it to work. Here is what I have been trying to work with index=printserver | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(_time) AS servtime | join type=inner _time [ search index=printlogs | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(_time) AS logtime ] | transaction startswith=eval(src="<servtime>") endswith=eval(src="<logtime>") maxspan=3s | table servtime prnt_name username location directory file Thanks for any assistance given on this one.
... View more
Labels
- Labels:
-
join
-
subsearch
-
transaction
10-21-2024
02:15 PM
Need help passing a token value from a Single Value Panel using the ( | stats count) in conjuction to the ( | rex field= _raw) command to a Stats Table panel. I created a dashboard showing various "winevent" logs for user accounts (created, enabled, disabled, deleted, etc...) Current search I have for my various Single Value panel using the stats command in my search is seen below. (for this example, I used the win event code 4720 to count of "User Account Created" on the network) and extracted the EventCode.
Acct Enable: index="wineventlog " EventCode=4720
| dedup user
| _rex=field _raw "(?m)EventCode=(?<eventcode>[\S]*)"
| stats count
Output gives me a Single Value Count for window event codes that = 4720 ignoring duplicate user records. I am now trying to capture the extracted "eventcode" using a drilldown in a token for each respective count panel. I have setup the token as:
(Set $token_eventcode$ = $click.value$)
in my drill down editor in my second query table. Using that token, I want to display the respective records in a second query panel to display the record(s) info in a table as seen below:
Acct Enable: index="wineventlog " EventCode=$token_eventcode$
| table _time, user, src_user, EventCodeDescription
As I am still learning how to use the rex command, having problems in this instance in capturing the EventCode from the _raw logs, setting it to the ($token_eventcode$) token in the Single Value County query and passing that value down through a token to the table while maintaining the stats count value.
Any assistance with be greatly appreciated.
... View more
10-18-2024
11:39 AM
After looking over my initial post, thought I would clarify a little more as to what I am after here. I am looking to get total print jobs that are "letter", total pages printed that are "letter" and total print jobs that are "11x17" (legal), total pages printed that are "11x17" in addition to my initial working query of sum of total print jobs and total pages printed logged by a specific printer Thanks
... View more
10-18-2024
11:10 AM
Have working query to give me list of all printers, total job count, total page count and show location of printers using a lookup. Sample Data, Lookup and query is: Sample Data print logs from index=printer prnt_name jobs pages_printed size_paper CS001 1 5 letter CS001 1 10 11x17 CS002 1 20 11x17 CS003 1 10 letter CS003 1 15 11x17 Lookup Data from printers.csv prnt_name location CS001 office CS002 dock CS003 front Splunk Query index=printer | stats count sum(pages_printed) AS tot_prnt_pgs by prnt_name, | lookup printers.csv prnt_name AS prnt_name OUTPUT location | stats sum(count) AS print_jobs by prnt_name | table prnt_name, location, count, tot_prnt_pgs Splunk Query Results prnt_name location count tot_prnt_pgs CS001 office 2 15 CS002 dock 1 20 CS003 front 2 25 I have been trying to use a (count (eval(if...))) clause but not sure how ot implement it or if that is the correct way to get the results I am after. I have been using various arguments from other Splunk posts but can't seem to make it work. Below is the output I am trying to get Output looking for: "ltr" represents letter and lgl represents 11x7. prnt_name location count tot_prnt_pgs ltr_count ltr_tot_pgs lgl_count lgl_tot pgs CS001 office 2 15 1 5 1 10 CS002 dock 1 20 0 0 1 20 CS003 front 2 25 1 10 1 15 Appreciate any time give on this.
... View more
10-14-2024
12:39 PM
Figured it out: *** File Extension Pie Chart: Works *** index="user_files" | rex field="document" "\.(?<extension>[^\.]*$$)" | stats count(extension) by extension However, when I call on the token "source = $token$" after declaring the index to display records based on pie chart selection, there is no search results. *** Records by file type selected in Pie Chart: No Records found with selection from Pie Chart ** index="user_files" | rex field="document" "\.(?<extension>[^\.]*$$)" | where extension = "$token$" | table ... Thanks PickleRick for given a response in helping figure this out. Much appreciate.
... View more
10-14-2024
12:16 PM
Realizing I need to run the rex command in my table because Splunk doesn't have any value in that search fin the raw data to associated with the token. Going to try some alternative queries for now to see if I can come up with the solution now considering that.
... View more
10-14-2024
12:07 PM
That was a type, copy and pasted. My token I am using in my search string is (source=$token$) Not sure where/why I added the (*) in the token name.
... View more
10-14-2024
11:58 AM
The token value I am trying to carry over in my table is the(token=$click.value$) using the field extracted In the drilldown editor. I have my values/parameters set to:
on click set "token"= $click.value$. I named my token name "Token" in the drilldown editor for simplicity.
In initial post I stated ***User Pie Chart with the drilldown token: token_user=$click.value$ *** but should by ***User Pie Chart with the drilldown token: "token"=$click.value$ ***
*** File Extension Pie Chart with the drilldown token: "token"=$click.value$ ***
index="user_files"
| rex field="document" "\.(?<extension>[^\.]*$$)"
| stats count(extension) by extension
However, when I call on the token "source = $token$" after declaring the index to display records based on pie chart selection, there is no search results.
*** Records by file type selected in Pie Chart: No Records found with selection from Pie Chart **
index="user_files" source=$*token$
| table _time, user_name, computer_name, source_directory, document
Apologize for the confusion. Hope that clears it up a little.
... View more
10-14-2024
11:24 AM
Need help with creating an interactive drill down with value extracted using the rex command. I want to monitor users saving files to a certain folder and also sort and look at file extension types that are saved in folder and by who. Raw test data has: time, user, computer, directory and document as seen below. Test Data _time user_name computer_name source_directory document 10/11/2024 user1 Destop_user1 \\cpn-local\priv\cus\ document1.pdf 10/11/2024 user4 Destop_user1 \\cpn-local\priv\cus\ document2.doc 10/10/2024 user1 Destop_user1 \\cpn-local\priv\cus\ document3.pdf 10/10/2024 user2 Destop_user2 \\cpn-local\priv\cus\ document4.pdf 10/9/2024 user3 Destop_user3 \\cpn-local\priv\cus\ document5.pdf 10/9/2024 user4 Destop_user4 \\cpn-local\priv\cus\ document6.doc 10/9/2024 user2 Destop_user2 \\cpn-local\priv\cus\ document7.doc I have created a drill using a token value of the queried data from the raw logs which allows me to selecte a user from a pie chart and show all logs in a second table. Those two dashboard panels are below and work. ***User Pie Chart with the drilldown token: token_user=$click.value$ *** index="user_files" | rex field="document" "\.(?<extension>[^\.]*$$)" | stats count(user_name) BY user_name ***User Record Table *** index="user_files" user_name = $token$ | table _time, user_name, computer_name, source_directory, document I am now trying to create a dashboard taking the same raw data, add a rex command to filter out extension and have the pie chart show the specific file extension I have logs from an index which I have done using the following query *** File Extension Pie Chart: Works *** index="user_files" | rex field="document" "\.(?<extension>[^\.]*$$)" | stats count(extension) by extension However, when I call on the token "source = $token$" after declaring the index to display records based on pie chart selection, there is no search results. *** Records by file type selected in Pie Chart: No Records found with selection from Pie Chart ** index="user_files" source=$*token$ | table _time, user_name, computer_name, source_directory, document I also tried (index="user_files" extension=$*token$") and ("|where extension="$token$") in the query and still no results are seen in the record table. Any help would be greatly appreciated. I understand the logic needed, just having problems executing the drill down. Thanks
... View more
Labels
- Labels:
-
drilldown
-
trellis layout
10-10-2024
06:46 AM
Thank you. Appreciate your assistance and input on helping me learn the finer details of Splunk and how the logic works. And yes, the lookup is .csv and not .cvs. Was a type-o. I have a sand box I work with for Splunk so manually type my searches on my work computer in the Splunk forum to help me learn the syntax better. Old school way of understanding how to learn something, especially when it comes to code. Thanks again.
... View more
10-09-2024
02:37 PM
Looking to see if Splunk has the ability to highlight a row in an output table based on a value in that row in a dashboard using dashboard studio. Created a dashboard to show printers using a lookup and number of print logs associated to a printer that is pulled from indexed print logs. I know how to highly a single row value based on a condition but wanted to know if the whole row can be highlighted using the output in the row: I used the color and style option to set conditions of the jobs field to highlight if print count = 0 Printer Jobs Prints Pntr_01 149 285 Pntr_02 25 78 Pntr_03 0 Pntr_04 75 528 Pntr_05 85 149 Pntr_06 0 Would like to highlight the printer name in red as well if the value = 0 Printer Jobs Prints Pntr_01 149 285 Pntr_02 25 78 Pntr_03 0 Pntr_04 75 528 Pntr_05 85 149 Pntr_06 0 I searched Splunk community as well as other areas of the Splunk matrix with no luck. If someone has some insight or reference if this can be done, it would be greatly appreciated. Thanks
... View more
Labels
- Labels:
-
Dashboard Studio
10-09-2024
01:12 PM
Looking for help running a stats count and stats count sum referencing a lookup using print logs. Looking to output all printers from a lookup to give "total job" count counting each record in the query for a single printer and giving a "total page" count for all pages that was printed for each printer listed in lookup.
Logs from my index
date printer_name user pages_printed 2024_10_09 prnt_01 user1 10 2024_10_09 prnt_02 user4 15 2024_10_09 prnt_01 user6 50 2024_10_09 prnt_04 user9 25 2024_10_09 prnt_01 user2 20
Data from my lookup file name: printers.cvs
printer_name printer_location prnt_01 main office prnt_02 front desk prnt_03 breakroom prnt_04 hallway
Looking for an output to give me results similar to what I provided below
Printer Name Location Print Jobs Pages Printed prnt_01 main office 3 80 prnt_02 front desk 1 15 prnt_03 breakroom 0 25 prnt_04 hallway 1 25
I have two separate queries for both respectively and having issues merging them together. My individual queries are:
Working query that gives me job count with sum of total jobs and total pages
index=printer sourcetype=printer:logs
| stats count sum(pages_printed) AS pages_printed by printer_name,
| lookup printers.csv printer_name AS printer_name OUTPUT printer_location
| table printer_name, printer_location, count, pages_printed
| rename printer_name AS "Printer Name", printer_location AS "Location", count AS "Print Job", pages_printed AS "Pages Printed",
Results
Printer Name Location Print Jobs Pages Printed prnt_01 main office 3 80 prnt_02 front desk 1 15 prnt_04 hallway 1 25
Working query that gives me list of all printers and job count
index=printer sourcetype=printer:logs
| eval printer_name=lower(printer_name)
| stats count BY printer_name
| append [| inputlookup printers.csv | eval printer_name=lower(printer_name), count=0 | fields printer_name count]
| stats sum(count) AS print_jobs by printer_name
| table printer_name, total
| rename printer_name AS "Printer Name", print_jobs AS "Print Job"
Results
Printer Name Print Jobs prnt_01 3 prnt_02 1 prnt_04 1
Again, trying to merge the two to give me Printer Name, Location, # of print jobs and total pages printed. Any assistance will be greatly appreciated.
... View more
10-09-2024
11:34 AM
Thanks for the help. Much appreciated.
... View more
10-04-2024
02:10 PM
Trying to monitor a separate print server folder outside where Splunk is hosted with print logs that has a UNC path. Folder only has .log files in it. I have the following index created:
index = printlogs
When I try to add the folder path in Splunk through the add data feature: "add data" - "Monitor" -"Files & Directories" I get to submit and then get an error:
"Parameter name: Path must be absolute".
So I added the following stanza to my inputs.conf file in the systems/local/folder:
[monitor://\\cpn-prt01\c$\Program Files\Printer\server\logs\print-logs\*.log]
index = printlogs
host = cpn-prt01
disabled = 0
renderXml = 1
I created a second stanza with a index = printlogs2 with respective index to monitor the following path to see if I can pull straight from the path and ignore the file type inside.
[monitor://\\cpn-prt01\c$\Program Files\Printer\server\logs\print-logs\]
I do see the full path to both in the "Files & Director" list under the Data Inputs. However, I am not getting any event counts when I look at the respective indexes seen in the Splunk Indexes page. I did a Splunk refresh and even restarted the Splunk server with now luck. Thought maybe someone has run into similar issue or has a possible solution.
Thanks in advance.
... View more
Labels
- Labels:
-
inputs.conf
-
monitor
09-26-2024
10:27 AM
Appreciate the help. This is working in part. For the server path, I am getting the proper output. However, for the drive path, I am getting a result as c:\program files\documents\ or F:\transfers\program\ and not c:\program files\ or F:\transfers\. Trying to make the output see that the drive letter is the root folder. I should have worded it as the root location. Also, I have done some review of rex/regex videos online and still learning and trying to decipher each part of the regular expression and how they are broken up to capture each part of the file path. Can you explain this a bit or point me to any additional tutorial that can help me understand this more. Much appreciated.
... View more
09-26-2024
09:30 AM
Need some assistance with creating a query where I am trying to capture the parent folder and the 1st child folder respectively from a print output log that has both windows and linux folder paths. Sample data and folder paths I am trying to get in a capture group is in bold. _time, username, computer, printer, source_dir, status 2024-09-24 15:32 , auser, cmp_auser, print01_main1, \\cpn-fs.local\data\program\..., Printed 2024-09-24 13:57 , buser, cmp_buser, print01_offic1, c:\program files\documents\..., Printed 2024-09-24 12:13 , cuser, cmp_cuser, print01_offic2, \\cpn-fs.local\data\transfer\..., In queue 2024-09-24 09:26, buser, cmp_buser, print01_offic1, F:\transfers\program\..., Printed 2024-09-24 09:26, buser, cmp_buser, print01_front1, \\cpn-fs.local\transfer\program\..., Printed 2024-09-24 07:19, auser, cmp_auser, print01_main1, \\cpn-fs.local\data\program\...., In queue I am currently using a Splunk query where I call these folders in my initial search, but I want to control this using a rex command so I can add an eval command to see if they were printed locally or from a server folder. Current query is: index=printLog source_dir IN ("\\\\cpn-fs.local\data\*", "\\\\cpn-fs.local\transfer\*", "c:\\program files\\*", " F:\\transfer\\*" ) status== "Printed" | table status, _time, username, computer, printer, source_dir I tried using the following rex but didn't get any return: | rex field=source_dir "(?i)<FolderPath>(?i[A-Z][a-z]\:|\\\\{1})[^\\\\]+)\\\\[^\\\\]+\\\\)" In my second effort, through Splunk I generated these two regex using the field extractor respectively. I know I need to pipe them to add the "OR" operator when comparing the windows and Linux paths but I get an error when trying to combine them. Regex generated from windows: c:\program files ^[^ \n]* \w+,,,(?P<FolderPath>\w+:\\\w+) Regex generated from linux: \\cpn-fs.local\data ^[^ \n]* \w+,,,(?P<FolderPath>\\\\\w+\-\w+\d+\.\w+\.\w+\\\w+) To start, I am looking for an output which should look like what is seen below to replace the "source_dir" with the rex "FolderPath" created _time, username, computer, printer, FolderPath, file, status 2024-09-24 15:32 , auser, cmp_auser, print01_main1, \\cpn-fs.local\data\, Printed 2024-09-24 13:57 , buser, cmp_buser, print01_offic1, c:\program files\, Printed Thanks for any help given.
... View more
Labels
- Labels:
-
field extraction
-
Linux
-
Windows
09-05-2024
10:19 AM
Hello, working on monitoring if someone has moved a file outside a specific folder inside a preset folder structure on a network using data from a CSV source. Inside csv, I am evaluating two specific fields used: Source_Directory and Destination_Directory I am trying to compare the two going 3 folders deep in the file path but running into issue when performing my rex command. Preset folder structure is: "\\my.local\d\p\" pulled from the data set used. Within the folder "\p\", there are various folder names. Need to eval if a folder path is different beyond the preset path of "\\my.local\d\p\..." I put in bold what a discrepancy would if there is one. Example data in CSV: Source_Directory Destination_Directory \\my.local\d\p\prg1\folder1\bfolder \\my.local\d\p\prg1\folder1\ffolder \\my.local\d\p\prg2\folder1 \\my.local\d\p\prg2\folder2 \\my.local\d\p\prg1\folder2 \\my.local\d\p\prg2\folder1\xfolder\mfolder\ \\my.local\d\p\prg3\folder2\afolder \\my.local\d\p\prg3\folder2 \\my.local\d\p\prg2\folder1 \\my.local\d\p\prg1\folder3 Output query I am trying to create Status Source_Directory Destination_Directory Same \\my.local\d\p\prg1\folder1\bfolder \\my.local\d\p\prg1\folder1\ffolder Same \\my.local\d\p\prg2\folder1 \\my.local\d\p\prg2\folder2 Different \\my.local\d\p\prg1\folder2 \\my.local\d\p\prg2\folder1\xfolder\mfolder\ Same \\my.local\d\p\prg3\folder2\afolder \\my.local\d\p\prg3\folder2 Different \\my.local\d\p\prg2\folder1 \\my.local\d\p\prg1\folder3
If folder name is different after the preset"\\my.local\d\p\" path I need that to show in the "Status" output. I have searched extensively on how to use this rex command in this instance with no luck so thought I would post my issue. Here is the search I have been trying to use. Splunk Search
host="my.local" source="file_source.csv" sourcetype="csv"
| eval src_dir = Source_Directory
| eval des_dir = Destination_Directory
| rex src_path = src_dir "(?<path>.*)\\\\\w*\.\w+$"
| rex des_path= des_dir "(?<path>.*)\\\\\w*\.\w+$"
| eval status = if (src_path = des_path, "Same", "Diffrent")
| table status, Source_Directory, Destination_Directory
Any assistance would be much appreciated.
... View more
Labels
- Labels:
-
eval
-
field extraction
-
rex