×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
codebased
Explorer
Member since: ‎06-13-2017
‎06-05-2020
Community Statistics
Posts 6
Solutions 0
Karma Given 2
Karma Received 0
Member Since ‎06-13-2017
Activity Feed
View All

aggregate url calls , ignoring number in the route

by in Splunk Search
‎08-29-2018 01:09 AM
‎08-29-2018 01:09 AM
HI Guys, I have a url like this: https://localhost/Client/V2/clients/23423/acc/view https://localhost/Client/V2/clients/23424/acc/view https://localhost/Client/V2/clients/23425/acc/view https://localhost/Client/V2/clients/23423/acc/basic https://localhost/Client/V2/clients/23423/acc/basic https://localhost/Client/V2/clients/23423/acc/basic https://localhost/Client/V2/clients/23425/acc/basic I want to group into two rows url | count https://localhost/Client/V2/clients/*/acc/view| 3 https://localhost/Client/V2/clients/*/acc/basic | 4 How can I aggregate? It is a url field. I tried with rex field=url "https://localhost/Client/V2/clients/(\d+)/*" | table url but it did not work. ... View more

Re: Extract a number from event message field

by in Splunk Search
‎06-14-2017 09:53 PM
‎06-14-2017 09:53 PM
Thank you so much for your help. It is resolved. I had to use _raw. ... View more

Re: Extract a number from event message field

by in Splunk Search
‎06-14-2017 09:53 PM
‎06-14-2017 09:53 PM
Indeed it is not a field! ... View more

Re: Extract a number from event message field

by in Splunk Search
‎06-14-2017 05:46 PM
‎06-14-2017 05:46 PM
This is what I have tried: APP_PATH="/Apiv0" EVENT_MESSAGE=Number of Offers ready to send | rex field=EVENT_MESSAGE "\D+(?\d+)" | table offercount My splunk log is: 2017-06-15 03:00:12.8818; LOG_LEVEL=Info; SOURCE=JobRepository; APP_PATH=/Apiv0; VERSION=0.1.0.90; CORRELATION_IDENTIFIER=fe800697-df6a-4ce6-9438-27d106ab0005; SERVER=XXXX; EVENT_MESSAGE=Number of Offers ready to send: 6 The result is: Events (14) - ... Statistics (14) - Empty List ... View more

Re: Extract a number from event message field

by in Splunk Search
‎06-13-2017 11:53 PM
‎06-13-2017 11:53 PM
Thank you @dineshraj9. I was actually using ? but somehow it got removed from my original question. I have copied your snippet as it is but it is not working :(. The offercount is all empty. ... View more

Extract a number from event message field

by in Splunk Search
‎06-13-2017 10:18 PM
‎06-13-2017 10:18 PM
Hi Guys, I have been trying to extract the number at the end of EVENT_MESSAGE field. Text sample: SERVER=SERVERNAME; EVENT_MESSAGE=Number of Offers ready to send: 6 I am using the following query: rex field=EVENT_MESSAGE "Number of Offers ready to send: (?<offercount>\d+$)" | table offercount However I am not getting any result; the offercount result is empty. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:03 AM
Karma given to
View All