Hi All - I am using the below query index=ABC "XYZ"| rex field=_raw "\"code\":\"(?.*)\"" | stats count by errorcode This gives me an output like this SR123","message":"Added Successfully." 2 SR456","message":"Declined." 4 the error code I am trying to extract is SR123 or SR456. How do I ensure the rex command ends errorcode at the 2nd " and only gives count for SR123 and SR456. Please help as I have never used rex field in command. Tried few hit and trial scenarios, didn't work. ... View more

The logging that we do is not perfect hence need some help. Log 1 (request) - {"date":"19-04-2018 21:40:11,221", "transactionId":"123", "className":"Class1", "methodName":"login", "elapsedTime":"2284896391"} Log 2 (response)- {"date":"19-04-2018 21:40:11,253", "transactionId":"123", "className":"Class1", "methodName":"login", "elapsedTime":"2317835633"} Log 1 is the request, Log 2 is the response. I want to find the duration of each login service request/ response. Transaction id is same in both cases so could be used as a unique value. Not sure what elapsedTime represents. Any help would be highly appreciated. ... View more

Hi, I have a search - index=ABC sourcetype=XYZ | stats values(user), dc(user) as usercount by region | eval region = region." (".usercount.")" | fields - usercount | transpose header_field=region | fields - column which gives me a list of user names by region as shown in picture 1 below. What I would prefer to see is the formatting in picture 2--where if number of user names become more than 3, the 4th one is shown adjacent to 1st. For the search I'd like to see that if the number of usernames is more than 15, they should be displayed in a two column kind of view. Is this possible in Splunk? ... View more

Hi All, I have a search - index=ABC sourcetype=XYZ | stats values(user), dc(user) by region | transpose header_field=region | fields – column which produces the following result: Region1 Region2 Region3 ABC XYZ MNO PQR STU BCD MKL 3 2 2 I want the count of distinct users to be appended to the column name in the table. Final result should look like the table below. Is this possible in Splunk? Region1(3) Region2(2) Region3(2) ABC XYZ MNO PQR STU BCD MKL Added a picture of the table to make it clear ... View more

I need to create a panel in dashboard which gives me list of activities till 23rd July 2017. Now, I don't want the start time to be fixed but it to be user defined in the panel, so I have created a dropdown where users can select time duration. Now, endtime ensures the output never goes beyond 23rd July. But I want the start time to be dynamic based on what user select. So if user selects last 30 days, start time should be 25th June and results should be from 25th June to 23 July. When I run the below query, it gives a parse error. Any solution to this please. How can I set starttime based on what user selects in the dropdown. <title>Activities (till 23rd July 2017)</title> <input type="time" token="time_token"> <label>Select Time duration</label> <default> <earliest>-30d@d</earliest> <latest>now</latest> </default> </input> <search> <query>index=ABC sourcetype=server123 starttime="$time_token.earliest$" endtime="07/23/2017:00:00:00" |stats count by activity <earliest>-30d@d</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </panel> ... View more