Hi Team, Thanks in advance, Need a quick help in Regex query, Input values:  KUL6LJBJ62YD BLR6LC7BLNJR HRI6M5G6KKPH KUL6LJ3N0F6J HRI6LBJKRHHR HRI6LB65G6NF   Expected output:  First 3 character of each phrase.   CUrrent Regex : (?<SITE_NAME>[^\W]{3})    << BUT AM not getting proper output>> Expected Output : | table SITE_NAME KUL BLR HRI KUL HRI HRI   Thanks Jerin V ... View more

Hi Team, I need a help in preparing a availability calculator.   Below graph is the requirement. Current output form code below:  DESCRIPTION downtime Time QIT-LAG 00:00:06 2022-07-31 QIT-LAG 00:00:09 2022-07-29 QIT-LAG 00:00:08 2022-07-29 QIT-LAG 00:00:10 2022-07-29   Current manual action:  1. Am extracting above table in excel, 2. converting all duration to seconds 3. grouing it with Day wise. 4. preparing a percentage loss out of 86400 (24*60*60) on each day is the graph. CODE:      index=opennms | search DESCRIPTION="QIT-LAG" | transaction nodelabel startswith=eval(Status="DOWN") endswith=eval(Status="UP") keepevicted=true | eval downtime=if(closed_txn=1,duration,null) | eval downtime=tostring(downtime, "duration") | fillnull value="" downtime | eval Status=if(closed_txn=1,"UP","DOWN") | rex field=downtime "(?P<downtime>[^.]+)" | rename _time as Time | fieldformat Time=strftime(Time,"%Y-%m-%d") | table DESCRIPTION, downtime, Time,       Challenge:  how to convert the current downtime into seconds and also add it with day basis and prpeare a percentage basis graph. Thanks In advance for guidance and help.        ... View more

Hi All, I have a code, that uses the output to fetch data from another Panel. First Panel   <title>Juniper Mnemonics</title> <table> <search> <query>index=nw_syslog | search hostname="*DCN*" | stats count by cisco_mnemonic, hostname | sort - count</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="drilldown">row</option> <option name="refresh.display">progressbar</option> <drilldown> <condition field="cisco_mnemonic"> <set token="message_token">$click.value$</set> </condition> <condition field="hostname"> <set token="hostname_token">$click.value$</set> </condition> <condition field="count"></condition> </drilldown> </table>     From this panel 2 contents are fetched for second panel search. Second Panel   index=nw_syslog | search hostname="*DCN*" | search cisco_mnemonic="$message_token$" | search hostname="$hostname_token$" | stats count by message | sort - count     Issue:  When ever i click the first panel table.( given ROW as Click Selection). its not getting fetching correctly. Only fetching "cisco_mnemonic" only for both cisco_mnemonic and hostname. Please guide me how can i get both in single click.     ... View more

Hi All, Need help in getting the right rex filter for the below _raw data.   2021-12-04T01:29:48.015524+00:00 USHCO-EXXON, ipsec-ike-down, 689, "IKE connection with peer 10.218.42.113 (routing-instance EXXON-Control-VR) is up", USPAB 2021-12-04T01:29:15.007722+00:00 USHCO-EXXON, ipsec-tunnel-down, 687, "IPSEC tunnel with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up", USPAB 2021-12-04T01:29:15.007722+00:00 USHCO-EXXON, ipsec-ike-down, 686, "IKE connection with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up", USPAB 2021-12-04T01:29:14.807814+00:00 USHCO-EXXON, ipsec-tunnel-down, 872, "IPSEC tunnel with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up", USPAB 2021-12-04T01:29:14.807814+00:00 USHCO-EXXON, ipsec-ike-down, 871, "IKE connection with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up", USPAB     Above is the raw data.   Requirement :  All the content within " " need to filtered. Example     "IKE connection with peer 10.218.42.113 (routing-instance EXXON-Control-VR) is up" "IPSEC tunnel with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up" "IKE connection with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up" "IPSEC tunnel with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up" "IKE connection with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up"     Above content to be filtered into Event_Log   | rex field=_raw "(?<Event_Log>[^"]+)"   But something am missing, its not capturing the data ... View more

Hi All, I want a small addition to the output values. Code am using :    | inputlookup ONMS_nodes.csv | table nodelabel | join type=outer nodelabel [ search index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown" | rex field=eventuei "uei.opennms.org/nodes/node(?<Status>.+)" | stats max(_time) as Time latest(Status) as Status by nodelabel | table nodelabel Status ] | table nodelabel Status     Output table :  nodelabel Status INBLR-LANCCO001 Up INBLR-LANCUA002 Up INBLR-LANCUA004 Up INBLR-LANCUA006 Up INBLR-LANCUA007   INBLR-LANCUA008 Up INBLR-WANRTC001 Up INBLR-WANRTC002 Up INBLR-WANRTC003     Reason some device not having status is, SNMP polling didnt happened for that device. I want a simplified output as expected below. Additional line of code:    | eval Device= nodelabel." [".Status."]"     Device INBLR-LANCCO001 [Up] INBLR-LANCUA002 [Up] INBLR-LANCUA004 [Up] INBLR-LANCUA006 [Up]   INBLR-LANCUA008 [Up] INBLR-WANRTC001 [Up] INBLR-WANRTC002 [Up]     Am not getting values for that missing SNMP devices. But i need that devices too in the table with [Failed] marked.  please help me with it. ... View more

Hi All, I have a code, that gives below output. CODE:  | inputlookup ONMS_nodes.csv | table nodelabel OUTPUT :  nodelabel LANCUA005 LANCUA008 LANCUA012 LANCUA014 LANCUA016 LANCUA018 LANCUA019 LANCUA020 LANCUA022 LANCUA023   This is a sample output. List can goes more than 600 or 700 devices.  Requirement is like :  Can we split this into multiple columns within the panel. nodelabel nodelabel LANCUA005 LANCUA016 LANCUA008 LANCUA018 LANCUA012 LANCUA019 LANCUA014 LANCUA020 LANCUA023 LANCUA022   SO that the content can be used the whole single panel  page to display the entire content. ... View more

Hi All, I am having challenge to filter the highest value and prepare a new column. Code:    index=nw_ppm | table "From Device", "To Device", "Latency", "Time (UTC/GMT)" | search Latency!=0 | eval Latency = round(Latency, 2) | rename "Time (UTC/GMT)" as Time | xyseries Time "From Device" "Latency"     Table am getting: Time IPSLA1 IPSLA2 IPSLA3 10:13:00   38  10.1 10:14:00 77.77     10:23:00 77  35  9.89 10:34:00 78.35     10:37:00     10.76 10:43:00 78 36.29 10.61 11:13:00 79     11:14:00 72.82     11:23:00   36.33   11:24:00 73.02     11:33:00   37.67   Requirement :  I want the highest value to be  populated on to a last new Colum. Expected output table:  Time IPSLA1 IPSLA2 IPSLA3 Highest 10:13:00   38  10.1 38 10:14:00 77.77     77.77 10:23:00 77  35  9.89 77 10:34:00 78.35     78.35 10:37:00     10.76 10.76 10:43:00 78 36.29 10.61 78 11:13:00 79     79 11:14:00 72.82     72.82 11:23:00   36.33   36.33 11:24:00 73.02     73.02 11:33:00   37.67   37.67   Also the "From Device" list is :    index=nw_ppm | table "From Device"   From Device IPSLA1 IPSLA2 IPSLA3 ... View more

Hi All, Need help in a Splunk code. Below is the data am having and a sample Table how the output looks like. Input data:  From To Latency CATRC CACCO 43.94 CATRC CATRC 0 CATRC GBLCO 148.61 CATRC GBLHD 88.06 CATRC INMCO 283.96 CATRC CACCO 43.94 CATRC CATRC 0 CATRC GBLCO 148.61 CATRC GBLHD 88.06 CATRC INMCO 283.96   Required Output Table:    CACCO CATRC GBLCO GBLHD INMCO CACCO 0 43.94 167.54 131.97 305.64 CATRC 44.61 0 148.61 88.06 283.96 GBLCO 167.54 148.61 0 3.51 137.96 GBLHD 131.97 88.06 3.51 0 5.5 INMCO 305.64 283.96 137.96 5.5 0   Challenge in getting Code for both X and Y axis in the table. ... View more