Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About shanksholla
shanksholla
Explorer
Member since:
08-04-2014
06-05-2020
Community Statistics
| Posts | 9 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 08-04-2014 |
Activity Feed
- Got Karma for How to drill down from a table into a chart within the same dashboard. 06-05-2020 12:47 AM
- Posted Re: How to split JSON array element into different events using props.conf on Getting Data In. 08-27-2015 04:33 AM
- Posted Re: How to split JSON array element into different events using props.conf on Getting Data In. 08-26-2015 02:18 AM
- Posted How to split JSON array element into different events using props.conf on Getting Data In. 08-25-2015 05:34 AM
- Tagged How to split JSON array element into different events using props.conf on Getting Data In. 08-25-2015 05:34 AM
- Tagged How to split JSON array element into different events using props.conf on Getting Data In. 08-25-2015 05:34 AM
- Tagged How to split JSON array element into different events using props.conf on Getting Data In. 08-25-2015 05:34 AM
- Tagged How to split JSON array element into different events using props.conf on Getting Data In. 08-25-2015 05:34 AM
- Posted Re: How to break events from JSON data. on Splunk Search. 08-17-2015 02:06 AM
- Posted Re: How to break events from JSON data. on Splunk Search. 08-11-2015 06:13 AM
- Posted How to break events from JSON data. on Splunk Search. 08-10-2015 10:41 PM
- Tagged How to break events from JSON data. on Splunk Search. 08-10-2015 10:41 PM
- Tagged How to break events from JSON data. on Splunk Search. 08-10-2015 10:41 PM
- Tagged How to break events from JSON data. on Splunk Search. 08-10-2015 10:41 PM
- Tagged How to break events from JSON data. on Splunk Search. 08-10-2015 10:41 PM
- Tagged How to break events from JSON data. on Splunk Search. 08-10-2015 10:41 PM
- Posted Re: How to drill down from a table into a chart within the same dashboard on Dashboards & Visualizations. 08-05-2014 10:17 PM
- Posted Re: How to drill down from a table into a chart within the same dashboard on Dashboards & Visualizations. 08-05-2014 06:22 AM
- Posted How to drill down from a table into a chart within the same dashboard on Dashboards & Visualizations. 08-05-2014 04:33 AM
- Tagged How to drill down from a table into a chart within the same dashboard on Dashboards & Visualizations. 08-05-2014 04:33 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 |
08-27-2015
04:33 AM
Can you please tell me how to parse before indexing. Is it using transforms.conf?
... View more
08-26-2015
02:18 AM
Thanks for your reply!
But with this, the leading curly braces (prior to "id") is left in previous event.
Also with this, it wouldn't be possible to parse the data in events into key value pairs using INDEXED_EXTRACTIONS or KV_MODE.
Please correct me if I'm wrong
... View more
08-25-2015
05:34 AM
Hi
I have a JSON message which looks like-
{
"data": [
{
"id": "X999_Y999",
"from": {
"name": "Tom Brady",
"id": "X12"
},
"message": "Looking forward to 2010!",
"actions": [
{
"name": "Comment",
"link": "http://www.facebook.com/X999/posts/Y999"
},
{
"name": "Like",
"link": "http://www.facebook.com/X999/posts/Y999"
}
],
"type": "status",
"created_time": "2010-08-02T21:27:44+0000",
"updated_time": "2010-08-02T21:27:44+0000"
},
{
"id": "X998_Y998",
"from": {
"name": "Peyton Manning",
"id": "X18"
},
"message": "Where's my contract?",
"actions": [
{
"name": "Comment",
"link": "http://www.facebook.com/X998/posts/Y998"
},
{
"name": "Like",
"link": "http://www.facebook.com/X998/posts/Y998"
}
],
"type": "status",
"created_time": "2010-08-02T21:27:44+0000",
"updated_time": "2010-08-02T21:27:44+0000"
}
]
}
Now, I would want to split this JSON array into different events. In this message, data from-
{
"id": "",
onwards would constitute different messages.
I have tried the following in props.conf, but all the data are shows up as single event.
[ json_split ]
TIME_FORMAT=%Y-%m-%dT%H:%M:%S+%4N
TIME_PREFIX="updated_time":\s"
SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE=(\{\s+"id")
NO_BINARY_CHECK=true
Can you please tell how to split this JSON array into different events.
... View more
08-17-2015
02:06 AM
Thanks for your reply. But this didn't work. Though all these regexes work fine in any regex tool, Splunk is not recognizing them. Basically, now all the data comes in one event.
... View more
08-11-2015
06:13 AM
Sorry! There was a typo in props.conf properties I gave. I meant-
BREAK_ONLY_BEFORE=\,\s*\{\s*"id":
I guess splunk answers stripped the escape characters. Basically I have used regex for white space.Hope BREAK_ONLY_BEFORE statement turned out right this time 🙂
Also, as suggested have used s+ instead of s*. But no luck with the event split.
... View more
08-10-2015
10:41 PM
Hi
I have JSON data which I have to break into events. The data looks somewhat like:
{ "data": [ { "id": "X999_Y999", "from": { "name": "foo Brady", "id": "P12" }, "message": "Looking forward to 2010!", "actions": [ { "name": "Comment", "link": "http://www.facebook.com/X999/posts/Y999" }, { "name": "Like", "link": "http://www.facebook.com/M999/posts/Z999" } ], "type": "status", "created_time": "2010-08-02T21:27:44+0000", "updated_time": "2010-08-02T21:27:44+0000" }, { "id": "A998_Z998", "from": { "name": "foo Manning", "id": "P18" }, "message": "Where's my contract?", "actions": [ { "name": "Comment", "link": "http://www.facebook.com/X998/posts/Z998" }, { "name": "Like", "link": "http://www.facebook.com/X998/posts/Z998" } ], "type": "status", "created_time": "2010-08-02T21:27:44+0000", "updated_time": "2010-08-02T21:27:44+0000" } ] }
I need to break this message into events at "id": "A998_Z998". That is-
}, { "id":
from this JSON message. I have tried the following for the props.conf-
BREAK_ONLY_BEFORE=,\s*{\s*"id":
INDEXED_EXTRACTIONS=json
KV_MODE=none
SHOULD_LINEMERGE=true
disabled=false
pulldown_type=true
The JSON key value pairs are extracted, but I'm not able to break the JSON message into events at the required place. Can you please help me with this?
... View more
08-05-2014
10:17 PM
This gave me what I wanted. Thank you!
... View more
08-05-2014
06:22 AM
Hi, thanks for your reply. This partially solves my problem. With this there is any empty chart before any row is clicked. Can I make the charts appear only after a row is clicked?
... View more
08-05-2014
04:33 AM
1 Karma
Hi
I have a table in my dashboard which displays total number of hits and the average response time for each operation.
index=gwlogs service=customer | stats count(operation_name) avg(transaction_time) by operation_name
A drill down for the table is present which provides the error code along with the count for the chosen operation. This appears in a new tab.
<![CDATA[/app/search/search?q=search index=gwlogs service=customer operation_name=$click.value$ | stats count by error_code&earliest=$earliest$&latest=$latest$]]>
Is it possible to have the drilled down chart appear below the initial table itself.
Thank you!
... View more
