About svodela

svodela · ‎01-02-2024

@gcusello - I was able to fine the way with rename "sgs1.0.*" source="/data/wso2/api_manager/current/repository/logs/wso2carbon.log" | rex "correlation-sit=(?<app>[A-Za-z]+)(?<version>\d+\.\d+\.\d+)" | table app version userId date_mday| dedup userId | sort version | fields "app", "date_mday", "userId", "version" | rename "date_mday" AS "Date"

svodela · ‎01-02-2024

Hello @gcusello , Sorry to come back , is there any way to change the table label. example of my search: "sgs1.0.*" source="/data/wso2/api_manager/current/repository/logs/wso2carbon.log" | rex "correlation-sit=(?<app>[A-Za-z]+)(?<version>\d+\.\d+\.\d+)" | table app version userId date_mday| dedup userId | sort version can my table looks like below app version userid Date ( rather than date_mday)

svodela · ‎01-02-2024

Thank you Giuseppe. Appreciate your support. This query has helped us to do what we are looking for.

svodela · ‎01-02-2024

We are trying to create a dashboard to understand the usage of our application version something like shown below Application Name Version sgs 1.0.18 When we search for particular index ""sgs1.0.18*" source="/data/wso2/api_manager/current/repository/logs/wso2carbon.log" we get below result. << uri="get api/mydetails/1.0.0/apime/employee-details?correlation-sit=sgs1.0.18u%26h%3d106", SERVICE_PREFIX="get api/mydetails/1.0.0/apime/employee-details?correlation-sit=sgs1.0.18u%26h%3d106", path="get api/mydetails/1.0.0/apime/employee-details?correlation-sit=sgs1.0.18u%26h%3d106", resourceMethod="get", HTTP_METHOD="get", resourceUri="api/mydetails/1.0.0/apime/employee-details?correlation-sit=sgs1.0.18u%26h%3d106" Could you please help us to give sample splunk query to achieve the results . Thanks

Posts	4
Solutions	1
Karma Given	1
Karma Received	0
Member Since	‎01-02-2024

Online Status	Offline
Date Last Visited	‎01-02-2024 08:34 PM

Fetch the details

Re: Fetch the details

Re: Fetch the details

Re: Fetch the details

Fetch the details