About tommasoscarpa1

tommasoscarpa1 · ‎07-30-2024

Thank you @PickleRick for your answer. Eventually I worked around the problem like this: | makeresults | eval amount = 10.6 | eval integer = floor(amount) | eval fraction = round(amount - floor(amount), 2) | eval compare = if(fraction = 0.6, "T", "F") I simply rounded the floating point number to some decimal places. I tested also your example and this solves this problem (that is not actually a problem as you suggested). Thank you!

tommasoscarpa1 · ‎07-30-2024

I see. So for Splunk 0.3 - 0.1 equals 0.19999999999 instead of 0.2. Do you know how can I work around this in my example?

tommasoscarpa1 · ‎07-30-2024

Hi, This thing is getting me crazy. I am running Splunk 9.2.1 and I have the following table: amount compare frac_type fraction integer 0.41 F Number 0.41 0 4.18 F Number 0.18 4 0.26 F Number 0.26 0 0.34 F Number 0.34 0 10.60 F Number 0.60 10 0.11 F Number 0.11 0 2.00 F Number 0.00 2 3.49 F Number 0.49 3 10.58 F Number 0.58 10 2.00 F Number 0.00 2 1.02 F Number 0.02 1 15.43 F Number 0.43 15 1.17 F Number 0.17 1 And these are the evals I used to calculate the fields: | eval integer = floor(amount) | eval fraction = amount - floor(amount) | eval frac_type = typeof(fraction) | eval compare = if(fraction = 0.6, "T", "F") Now, I really can't understand how the "compare" field is always false.... I was expecting it to output TRUE on row 5 with amount = 10.60, which means fraction = 0.6, but it does not. What am I doing wrong here? Why "compare" evaluates to FALSE on row 5? I tried to change 0.6 with 0.60 (you never know), but no luck. If you want you can try this run anywhere search, which gives me the same result: | makeresults | eval amount = 10.6 | eval integer = floor(amount) | eval fraction = amount - floor(amount) | eval frac_type = typeof(fraction) | eval compare = if(fraction = 0.6, "T", "F") Can you help me? Thank you in advance, Tommaso

tommasoscarpa1 · ‎07-11-2024

I got it: | eval start_time=strptime(start_time,"%Y/%m/%d %H:%M") | eval end_time=strptime(end_time,"%Y/%m/%d %H:%M") | eval range_start_time = relative_time(start_time, "@h") | eval range_end_time = relative_time(end_time, "+1h@h") | eval range_start_time=mvrange(range_start_time, range_end_time, "1h") | mvexpand range_start_time | eval range_end_time=range_start_time+3600 | eval end_time=min(range_end_time, end_time) | eval start_time=max(range_start_time, start_time) | eval start_time=strftime(start_time,"%Y/%m/%d %H:%M") | eval end_time=strftime(end_time,"%Y/%m/%d %H:%M") | eval range_start_time=strftime(range_start_time,"%Y/%m/%d %H:%M") | eval range_end_time=strftime(range_end_time,"%Y/%m/%d %H:%M")

tommasoscarpa1 · ‎07-11-2024

It works like a charm!! Thank you!! EDIT----- No. Sorry My bad. I realized I forgot to mention that timestamps are not always at :00. I've updated the question. Would you have any suggestion on how to round use your solution to keep into account the minutes? Thank you

tommasoscarpa1 · ‎07-11-2024

Hello, I have this data set: event, start_time, end_time EV1, 2024/07/11 12:05, 2024/07/11 13:05 EV2, 2024/07/11 21:13, 2024/07/12 04:13 EV3, 2024/07/13 11:22, 2024/07/14 02:44 I need to split the time intervals into hourly intervals. One interval for each row. Eventually I'm looking for an output like this: event, start_time, end_time EV1, 2024/07/11 12:05, 2024/07/11 13:00 EV1, 2024/07/11 13:00, 2024/07/11 13:05 EV2, 2024/07/11 21:13, 2024/07/12 22:00 EV2, 2024/07/11 22:00, 2024/07/12 23:00 EV2, 2024/07/11 23:00, 2024/07/12 00:00 EV2, 2024/07/11 00:00, 2024/07/12 01:00 EV2, 2024/07/11 01:00, 2024/07/12 02:00 EV2, 2024/07/11 02:00, 2024/07/12 03:00 EV2, 2024/07/11 03:00, 2024/07/12 04:00 EV2, 2024/07/11 04:00, 2024/07/12 04:13 EV3, 2024/07/13 11:22, 2024/07/14 12:00 EV3, 2024/07/13 12:00, 2024/07/14 13:00 EV3, 2024/07/13 13:00, 2024/07/14 14:00 EV3, 2024/07/13 14:00, 2024/07/14 15:00 EV3, 2024/07/13 15:00, 2024/07/14 16:00 EV3, 2024/07/13 16:00, 2024/07/14 17:00 EV3, 2024/07/13 17:00, 2024/07/14 18:00 EV3, 2024/07/13 18:00, 2024/07/14 19:00 EV3, 2024/07/13 19:00, 2024/07/14 20:00 EV3, 2024/07/13 20:00, 2024/07/14 21:00 EV3, 2024/07/13 21:00, 2024/07/14 22:00 EV3, 2024/07/13 22:00, 2024/07/14 23:00 EV3, 2024/07/13 23:00, 2024/07/14 00:00 EV3, 2024/07/13 00:00, 2024/07/14 01:00 EV3, 2024/07/13 01:00, 2024/07/14 02:00 EV3, 2024/07/13 02:00, 2024/07/14 02:44 I tried using bin or timechart command but they don't work. Do you guys have any sugestion? Thank you, Tommaso

tommasoscarpa1 · ‎05-17-2024

Hi Giuseppe, I am not talking about XML tags, but HTML tags. HTML tags are used to format the text and do not give any information about fields. Text between and will be formatted in bold and is a line break. I would like to remove these unnecessary characters from my inputs. Ciao! Tommaso

tommasoscarpa1 · ‎05-17-2024

Hi, I would like to remove every occurrence of a specific pattern from my _raw events. Specifically in this case I am looking for deleting these html tags: , , Example, I have this raw event: This<\b> is an example<\b> of raw event And I would like to transform it like this: This is an exampleof rawevent I tried to create this transforms.conf: [remove_html_tags] REGEX = <\/?br?> FORMAT = DEST_KEY = _raw And this props.conf: [_sourcetype_] TRANSFORMS-html_tags = remove_html_tags But it doesn't work. I also thought I could change the transforms.conf like this: [remove_html_tags] REGEX = (.*)<\/?br?>(.*) FORMAT = $1$2 DEST_KEY = _raw But it will stop after just one substitution and the REPEAT_MATCH property is not suitable because the doc says: NOTE: This setting is only valid for index-time field extractions. This setting is ignored if DEST_KEY is _raw. And I must set DEST_KEY = _raw Can you help me? Thank you in advance.

tommasoscarpa1 · ‎01-31-2024

Hi @PickleRick Works like a charm! Thank you! It's way better than reverting to the /raw endpoint. Unfortunately I can't mark your answer as a solution anymore. I will edit my solution adding what you suggested. Thank you!

tommasoscarpa1 · ‎01-30-2024

--- IMPORTANT EDIT --- After I accepted this solution, user @PickleRick suggested a way better one, so I am reporting it here for future use: The /event endpoint gives you more flexibility than /raw so I'd advise to use /event anyway. But in order for HEC input _not_ to skip the timestamp recognition (which it does by default - it either gets the timestamp from the field pushed with (not in!) an event or assigns current timestamp), you must add the ?auto_extract_timestamp=true parameter to the url. Like https://your_indexer:8088/services/collector/event?auto_extract_timestamp=true Here below my original answer: Hi @gcusello I tried this too but no luck. Eventually I solved my problem by changing the HEC endpoint. I was sending data to "/services/collector/event" endpoint. I changed to "/services/collector/raw" and time was indexed correctly with only the TIME_FORMAT property. Thank you for your help anyway!

tommasoscarpa1 · ‎01-30-2024

Hi @gcusello No, that is just an example. I don't actually have the characters "METRIC_NAME" in my data. METRIC_NAME can be anything from "CPU usage" to "paychek value" or whatever. That's why I tried TIME_PREFIX = \S+\s\S+\s at first. I'll edit the examples in my original post to avoid misunderstandings

tommasoscarpa1 · ‎01-30-2024

Hi Giuseppe. I've added an example in my original post

tommasoscarpa1 · ‎01-30-2024

Hello, I have events in this format: <servername> <metricname> <epochtime> <metricvalue> These events comes from HEC to an heavy forwarder and are then forwarded to indexers. I would like to set Splunk to recognize <epochtime> as the event timestamp. <servername> and <metricname> are alphanumerical words with no whitespaces inside, while <metricvalue> is numerical. <epochtime> is a 10 digits, integer epoch time. I've set up props.conf file on heavy forwarder as follows: [sourcetypename] TIME_FORMAT = %s But events are not indexed with the correct timestamp. I also tried to add this property: TIME_PREFIX = \S+\s\S+\s But no luck. Can you help me understand what am I doing wrong? EDIT---- Log example: mywebserver123 SOME_METRIC 1706569460 5 myotherwebserver456.domain.com ANY_OTHER_NAME 1706569582 3

Posts	13
Solutions	3
Karma Given	5
Karma Received	0
Member Since	‎01-30-2024

Online Status	Offline
Date Last Visited	‎08-05-2024 12:08 PM

Number comparison seems not to be working

Split time period into shorter intervals

Remove every occurrence of pattern from _raw event

Configure event timestamp recognition from epoch

Re: Number comparison seems not to be working

Re: Number comparison seems not to be working

Number comparison seems not to be working

Re: Split time period into shorter intervals

Re: Split time period into shorter intervals

Split time period into shorter intervals

Re: Remove every occurrence of pattern from _raw e...

Remove every occurrence of pattern from _raw event

Re: Configure event timestamp recognition from epo...

Re: Configure event timestamp recognition from epo...

Re: Configure event timestamp recognition from epo...

Re: Configure event timestamp recognition from epo...

Configure event timestamp recognition from epoch

Are you a member of the Splunk Community?