About babidi

babidi · ‎01-23-2018

Now fields are set up as: account,login,webservice,date,time , I am using regex to pull the webservice call name in this case PSAccountInfoDefault as search criteria..but I am not sure what should be in <> in eval Request_Time regex _raw="(?>"),strftime(_time,"%F %T"),null() | eval Response_Time=if(isnull(Request_Time),strftime(_time,"%F %T"),null()) | stats values(*) as * range(_time) as Difference by Account_Number | eval Difference=tostring(Difference,"duration")

babidi · ‎01-22-2018

By <> I dont know what it means "your base search to fetch both request and response event" If I understand correctly my base search would be to look for the keyword: GetPSAccountInfoDefault in both response and request in addition to accountnumber , in request it is mentioned as 123456789 and in response it comes as ERROR: ETRGetPSAccountInfoDefault returned 0 records for account=123456789 how do I translate the above search search criteria and then extract fields as I never extracted fields before and get my desired output

babidi · ‎01-22-2018

I am not sure what should be in <> ? I don't have field extraction and not sure how can I do it considering the format of request and response. Can anyone assist for these?

babidi · ‎01-22-2018

To illustrate what I am looking forward is lets consider one sample request / response from the log : REQUEST: 05 Jan 2018 16:45:19,951 - INFO http-bio-8080-exec-409 - Inbound Message ID: 1682148 Address: http://internalservices.abc.com/ERPPeoplesoftService/service/PsciServiceImplPort/erpService?bridgeEndpoint=true&throwExceptionOnFailure=false Encoding: ISO-8859-1 Http-Method: POST Content-Type: text/xml Headers: {Accept=[/], breadcrumbid=[ID-XYZ-INT-ESB01-407etr-com-19853-1510587197074-50-2354125], cache-control=[no-cache], connection=[keep-alive], Content-Length=[503], content-type=[text/xml], host=[internalservices.407etr.com], pragma=[no-cache], user-agent=[Apache CXF 2.5.0]} Payload: <psci:getPSAccountInfoDefault xmlns:ns2="http://erp.ABC.com" xmlns:psci="http://psci.etr407.com"> <defaultAcctNo>123456789</defaultAcctNo> <doLinking>true</doLinking> <isUdlAccount>false</isUdlAccount> <source>WEB</source> <dateFrom>12/17/2017</dateFrom> <dateTo>01/05/2018</dateTo> </psci:getPSAccountInfoDefault> RESPONSE: Jan 5 16:48:25 MyAccount ERROR: com.ebpsource.ABCConsumer.Customer0: - E0 00300 Customer0 - ERROR: ETRGetPSAccountInfoDefault returned 0 records for account=123456789 loginId=JOHN@ROGERS.COM Based on the common key word in the response and request that is getPSAccountInfoDefault I would like to fetch the result in the output format as below: Name of WS call, Acct Number, Email ID, REQUEST DATE-TIME, RESPONSE DATE-TIME getPSAccountInfoDefault,123456789 , JOHN@ROGERS.COM, 05 Jan 2018 16:45:19,Jan 5 16:48:25

babidi · ‎01-12-2018

Hello Splunk Support Community: I am trying to find the difference between request and response from the log. For information purpose this is the request format: 05 Jan 2018 16:45:19,951 - INFO http-bio-8080-exec-409 - 9999999: begin getAccountDefault() For information purpose this is the response format Jan 5 16:48:25 MyAccount ERROR: com.ebpsource.XYZ123Consumer.Customer0: - E0 00300 Customer0 - ERROR: XYZGetAccountDefault returned 0 records for account=9999999 loginId=xyz@abc.om dateFrom=12/17/2017 dateTo=01/05/2018 doLinking=true isUDLAccount=false. What I am trying to achieve are following: (1)- Get the difference between the Response and Request i.e if you see you above the Request starts with 05 Jan 2018 16:45:19 and likewise Response contains : Jan 5 16:48:25 , I like to get the difference for these timestamps The End Result should look like in tabular format : Account Number , Email Address, Function/Webservice Call Name, Request Time, Response Time, Difference 9999999 , xyz@abc.om,getAccountDefault(),05 Jan 2018 16:45:19, Jan 5 16:48:25,3 minutes and 3 seconds The above result should be clickable to take it the log stack trace.

babidi · ‎05-03-2017

I tried the following recommended search option: index =os host = myaccount ("COMPLETED Login" OR "Password not matched")|eval failTime=if(result="Failure",strftime(_time,"%Y-%m-%d %H:%M:%S"),null()) | eval failCount=if(result="Failure",1,0) | eval succTime=if(result="Success",strftime(_time,"%Y-%m-%d %H:%M:%S"),null()) | eval succCount=if(result="Success",1,0) | bin _time span=1d | stats sum(failCount) as FailureCount, values(failTime) as FailureTimes, sum(succCount) as SuccessCount, values(succTime) as SuccessTimes by EmailAdd _time For some reason the output for count columns (FailureCount, FailureTimes,SuccessCount & SuccessTimes are all zero except the initial first few columns i.e. EmailAdd and _time. It worked once but now its not. Also how can I create a BAR chart graph from this result. Please advise

babidi · ‎05-02-2017

Thanks DalJeanis. Only question why the extracted field: EmailAdd field is not visible when the search happens for "Password not matched", using field extractor I tried sample log for "Password not matched" , however it says EmailAdd field already exists. The only thing different between the log for "Complete Login" and "Password not matched" is the position of Email Address.

babidi · ‎05-02-2017

Following Step 1: Log in to Splunk Web and navigate to Apps > Manage Apps.... After that I dont see any button to Install App from file... Please advise?

babidi · ‎05-02-2017

The following are sample logs for successful login and incorrect password attempts based on email address: May 2 00:19:58 MyAccount INFO: com.ebpsource.Consumer.Customer0: - I3 00100 Customer0 - *****COMPLETED Login xyz@gmail.com May 2 00:21:31 MyAccount ERROR: com.ebpsource.Consumer.Customer: - E0 35010 Customer - Password not matched when logging on user xyz@GMAIL.COM (external user key of 20102:1570022) from IP address 10.211.140.27 The following is the required output: Email Address Successgful Login Attempts Incorrect Password Attempts Date xyz@gmail.com 4 2 02-May-2017 abc@hotmail.com 1 6 01-May-2017 wert@abc.com 3 4 38-Apr-2017 Appreciate feedback as to what should be the search criteria to extract both this information for successful logins/incorrect passwords attempt by users: Right now I am able to gather one portion of information using the following search criteria: index =os host = myaccount "COMPLETED Login" | stats count as "Successfull Login Attempts" by EmailAdd However I like to also have the counts for incorrect password attempts along with date added in this result, I tried using the following APPEND command to add it but doesnt work: index =os host = myaccount "COMPLETED Login" | stats count as "Successfull Login Attempts" by EmailAdd | append [search index =os host = myaccount "Password not matched" | stats count as "Incorrect Password Attempts" by EmailAdd]

Posts	9
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎05-02-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Creating a tabular result along with chart

Counting from log based on email add for successfu...

Re: Creating a tabular result along with chart

Re: Creating a tabular result along with chart

Re: Creating a tabular result along with chart

Re: Creating a tabular result along with chart

Creating a tabular result along with chart

Re: Counting from log based on email add for succe...

Re: Counting from log based on email add for succe...

Re: How to install a splunk app?

Counting from log based on email add for successfu...

Are you a member of the Splunk Community?