×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
ivoZgu
Explorer
Member since: ‎09-04-2024
‎10-11-2024
Community Statistics
Posts 5
Solutions 1
Karma Given 0
Karma Received 0
Member Since ‎09-04-2024
Activity Feed
View All

Re: Optimized Rex

by in Splunk Enterprise
‎09-13-2024 07:30 AM
‎09-13-2024 07:30 AM
Thank you! Unfortuantely | rex "#HLS#\s*IID:\s*(?P<IID>[^,]+),\s*.*#HLE#" | rex "#HLS#\s*IID:\s*[^,]+,\s*STEP:\s*(?P<STEP>[^,]+),\s*.*#HLE#" | rex "#HLS#\s*IID:\s*[^,]+,\s*STEP:\s*[^,]+,\s*PKEY:\s*(?P<PKEY>.*?),\s*.*#HLE#" | rex "#HLS#\s*IID:\s*[^,]+,\s*STEP:\s*[^,]+,\s*PKEY:\s*.*?,\s*STATE:\s*(?P<STATE>[^,]+),\s*.*#HLE#" | rex "#HLS#\s*IID:\s*[^,]+,\s*STEP:\s*[^,]+,\s*PKEY:\s*.*?,\s*STATE:\s*[^,]+,\s*MSG0:\s*(?P<MSG0>.*?),\s*.*#HLE#" | rex "#HLS#\s*IID:\s*[^,]+,\s*STEP:\s*[^,]+,\s*PKEY:\s*.*?,\s*STATE:\s*[^,]+,\s*MSG0:\s*.*?,\s*EXCID:\s*(?P<EXCID>[a-zA-Z_]+),\s*.*#HLE#" | rex "#HLS#\s*IID:\s*[^,]+,\s*STEP:\s*[^,]+,\s*PKEY:\s*.*?,\s*STATE:\s*[^,]+,\s*MSG0:\s*.*?,\s*EXCID:\s*[a-zA-Z_]+,\s*PROPS:\s*(?P<PROPS>[^#]+)\s*#HLE#" did not help much. ... View more

Re: Search in Table

by in Dashboards & Visualizations
‎09-13-2024 01:46 AM
‎09-13-2024 01:46 AM
env=$env_dd$ "#HLS#" "#HLE#" "$interface_dd$" "$step_dd$" "$record_id$" "$state_dd$" "$message_1$" "$exception_id$" "$properties$" | rex "#HLS#\s*IID:\s*(?P<IID>[^,]+),\s*STEP:\s*(?P<STEP>[^,]+),\s*PKEY:\s*(?P<PKEY>.*?),\s*STATE:\s*(?P<STATE>[^,]+),\s*MSG0:\s*(?P<MSG0>.*?),\s*PROPS:\s*(?P<PROPS>[^#]+)\s*#HLE#" | search IID="*$interface_dd$*" STEP="*$step_dd$*" PKEY="*$record_id$*" STATE="*$state_dd$*" MSG0="*$message_1$*" PROPS="*$properties$*" | fields IID STEP PKEY STATE MSG0 PROPS _time | table IID STEP PKEY STATE MSG0 PROPS _time | rename IID as "Interface ID", STEP as "Step", PKEY as "Primary Key", STATE as "State", MSG0 as "Message", EXCID as "Exception Code", PROPS as "Properties" ... View more

Re: Optimized Rex

by in Splunk Enterprise
‎09-13-2024 01:41 AM
‎09-13-2024 01:41 AM
Hey @ITWhisperer , You are absolutely right, just have edited the rex . I am not using max_match. This error appears once there are a lots of matching events.  On the other hand rex with less steps and one property (exclude EXCID) less achieves to retrieve all events and no error thrown. | rex "#HLS#\s*IID:\s*(?P<IID>[^,]+),\s*STEP:\s*(?P<STEP>[^,]+),\s*PKEY:\s*(?P<PKEY>.*?),\s*STATE:\s*(?P<STATE>[^,]+),\s*MSG0:\s*(?P<MSG0>.*?),\s*PROPS:\s*(?P<PROPS>[^#]+)\s*#HLE#" Thanks! BR, Ivo ... View more

Optimized Rex

by in Splunk Enterprise
‎09-12-2024 05:48 AM
‎09-12-2024 05:48 AM
Hey All, Can anybody help me with optimization of this rex: | rex "#HLS#\s*IID:\s*(?P<IID>[^,]+),\s*STEP:\s*(?P<STEP>[^,]+),\s*PKEY:\s*(?P<PKEY>.*?),\s*STATE:\s*(?P<STATE>[^,]+),\s*MSG0:\s*(?P<MSG0>.*?),\s*EXCID:\s*(?P<EXCID>[a-zA-Z_]+),\s*PROPS:\s*(?P<PROPS>[^#]+)\s*#HLE#" Example log: "#HLS# IID: EB_FILE_S, STEP: SEND_TOF, PKEY: Ids:100063604006, 1000653604006, 6000125104001, 6000135104001, 6000145104001, 6000155104001, STATE: IN_PROGRESS, MSG0: Sending request to K, EXCID: dcd, PROPS: EVENT_TYPE: SEND_TO_S, asd: asd #HLE# ERROR: "Streamed search execute failed because: Error in 'rex' command: regex="#HLS#\s*IID:\s*(?P<IID>[^,]+),\s*STEP:\s*(?P<STEP>[^,]+),\s*PKEY:\s*(?P<PKEY>.*?),\s*STATE:\s*(?P<STATE>[^,]+),\s*MSG0:\s*(?P<MSG0>.*?),\s*EXCID:\s*(?P<EXCID>[a-zA-Z_]+),\s*PROPS:\s*(?P<PROPS>[^#]+)\s*#HLE#" has exceeded configured match_limit, consider raising the value in limits.conf." ... View more

Search in Table

by in Dashboards & Visualizations
‎09-04-2024 07:06 AM
‎09-04-2024 07:06 AM
  (index=hcp_system OR index=hcp_logging) namespace=$env_dd$ | rex "#HLS#\s*IID:\s*(?P<IID>[^,]+),\s*STEP:\s*(?P<STEP>[^,]+),\s*PKEY:\s*(?P<PKEY>[^,]+),\s*STATE:\s*(?P<STATE>[^,]+),\s*MSG0:\s*(?P<MSG0>[^,]+),\s*PROPS:\s*(?P<PROPS>[^#]+)\s*#HLE#" | eval IID=if("$interface_dd$"!="", "$interface_dd$", IID), STEP=if("$step_dd$"!="", "$step_dd$", STEP), PKEY=if(isnull("$record_id$") OR "$record_id$"="", PKEY, "*" . "$record_id$" . "*"), STATE=if("$state_dd$"!="", "$state_dd$", STATE), MSG0=if(isnull("$message_1$") OR "$message_1$"="", MSG0, "*" . "$message_1$" . "*"), PROPS=if(isnull("$properties$") OR "$properties$"="", PROPS, "*" . "$properties$" . "*") | search (IID=* OR isnull(IID)) (STEP=* OR isnull(STEP)) (PKEY=* OR isnull(PKEY)) (STATE=* OR isnull(STATE)) (MSG0=* OR isnull(MSG0)) (PROPS=* OR isnull(PROPS)) | table IID STEP PKEY STATE MSG0 PROPS   How to make it show in the table values which are selected in DD and if the search field is "text field" (PKEY MSG0 and PROPS in my case) empty to show what the rex  PKEY:\s*(?P<PKEY>[^,]+) will extract. As current behavior is following: DD DropDown TF Text Field Input : -DD  IID:SF  -DD  STEP:RECEIVE_FROM_KAFKA -DD  STATE:IN_PROGRESS -TF  PKEY MSG0 and PROPS are empty Msg1:"#HLS# IID:SF, STEP:RECEIVE_FROM_KAFKA, PKEY:456, STATE:IN_PROGRESS, MSG0:Success, PROPS:YES #HLE#" Msg2: "#HLS# IID:SAP, STEP:SEND_TO_KAFKA, PKEY:52345345, STATE:IN_PROGRESS, MSG0:MOO, PROPS:FOO #HLE#" Extracted Table: STEP                                        |   PKEY             |       STATE                   |  MSG0      | PROPS RECEIVE_FROM_KAFKA |    52345345 |       IN_PROGRESS |  MOO         | YES   Resume: the result is mixed in column lines from different messages in the input of the text fields is empty, How can I make it to extract all messages with the following log pattern and then filter them based on the DD or text fields? ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎10-11-2024 01:55 PM