About guru333

guru333 · ‎02-09-2025

Hi, I want to ignore below line inside splunk alerts payload if email address is not provided buy user. "action.email.to": {email}, What is best way to do this and if /else statement inside payload throws syntax error.

guru333 · ‎07-16-2024

Tried to use "_raw =errortrace" in fields alias section...it did not pick up this field alias.

guru333 · ‎07-15-2024

Hi, I had been using search syntax "rename "_raw" AS errortrace" in my custom search but one of my app team needs _raw data to extract some header info. How can i still pass _raw filed data still with renamin syntax still in place Thanks

guru333 · ‎05-02-2024

I need to skip 1st 10 lines of key field "_raw"

guru333 · ‎04-29-2024

Also /test1/folder1/scripts/monitor/log/env/dev/Error.log is dynamic source field value and not hardcoded value /test1/folder1/scripts/monitor/log/env/dev/Error.log so I need to integrate index command with makeresults something like this index="monitoring" source="/test1/folder1/.scripts/monitor/log/env/dev/Error.log" extract values of env and dev...that can be dynamic to separate fields.

guru333 · ‎04-29-2024

yes /test1/folder1/.scripts/monitor/log/env/dev/Error.log I want field 1=value of env field 2=value of dev as there is scope of this changing later.

guru333 · ‎04-29-2024

sorry for confusion. I want to skip 1st 7 lines of environment variable "_raw" and then copy that info from 7th line to new variable "_raw_refined"

guru333 · ‎04-29-2024

I want to execute this skip first 7 lines on splunk default environment variable "_raw" and not on eval _raw="line 1 line 2 line 3 line 4 line 5 line 6"

guru333 · ‎04-29-2024

Thanks for your response But my file location is /test1/folder1/.scripts/monitor/log/env/dev/Error.log So interested to get both values of env and dev

guru333 · ‎04-29-2024

_raw= line 1 line 2 line 3 line 4 line 5 line 6 how to define another new field "copyofraw" to contain just line 5 and line 6

guru333 · ‎04-29-2024

Hi, How do I extract word "Dev" from below file location source=/test1/folder1/scripts/monitor/log/env/dev/Error.log and add some if condition statements like if word=dev,change it to development word=test,change it to loadtest in splunk query. Thanks

Posts	11
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎04-29-2024

Online Status	Offline
Date Last Visited	‎02-09-2025 07:52 PM

ignore a line in splunk payload if a variable is n...

_rawdata

skip first 10 lines of search results

extract a name from file location

ignore a line in splunk payload if a variable is n...

Re: _rawdata

_rawdata

Re: skip first 10 lines of search results

Re: extract a name from file location

Re: extract a name from file location

Re: skip first 10 lines of search results

Re: skip first 10 lines of search results

Re: extract a name from file location

skip first 10 lines of search results

extract a name from file location

Join the Conversation