Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About sen8sen
sen8sen
Engager
Member since:
04-28-2020
07-19-2020
Community Statistics
| Posts | 11 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 04-28-2020 |
Activity Feed
- Posted Re: Extract a Particular value from a already extracted field on Splunk Search. 07-19-2020 05:05 AM
- Posted Re: Extract a Particular value from a already extracted field on Splunk Search. 07-16-2020 04:07 PM
- Tagged Re: Extract a Particular value from a already extracted field on Splunk Search. 07-16-2020 04:07 PM
- Posted Re: Extract a Particular value from a already extracted field on Splunk Search. 07-16-2020 06:35 AM
- Tagged Re: Extract a Particular value from a already extracted field on Splunk Search. 07-16-2020 06:35 AM
- Posted Extract a Particular value from a already extracted field on Splunk Search. 07-15-2020 04:49 PM
- Posted Splunk Dashboard to Confluence as RSS Feed URL on Dashboards & Visualizations. 06-29-2020 04:44 PM
- Posted Re: Need help with REX after a String on Dashboards & Visualizations. 06-20-2020 05:28 PM
- Posted Need help with REX after a String on Dashboards & Visualizations. 06-20-2020 04:28 PM
- Posted Re: Response Time from Splunk Logs using Transaction starts with and within an single event on Splunk Search. 04-30-2020 11:00 AM
- Posted Re: Response Time from Splunk Logs using Transaction starts with and within an single event on Splunk Search. 04-29-2020 02:31 PM
- Posted Re: Response Time from Splunk Logs using Transaction starts with and within an single event on Splunk Search. 04-29-2020 10:20 AM
- Posted Response Time from Splunk Logs using Transaction starts with and within an single event on Splunk Search. 04-28-2020 05:16 PM
- Tagged Response Time from Splunk Logs using Transaction starts with and within an single event on Splunk Search. 04-28-2020 05:16 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-19-2020
05:05 AM
Thanks a lot -:). Will try.
... View more
07-16-2020
04:07 PM
Hi Thanks for your response. But it didnt help. Not sure, if I have explained earlier clearly. I have a field called Response which contains response in the below format. {"responseDateTime":1594937190449,"status":"SUCCESS",{"value":"********","jurisdictionLevel":"******","jurisdictionId":******,"effectiveDate":null,"expirationDate":null,"externalJurisdictionCode":null},"Jurisdiction":null,"Tax":0.0,"effectRate":3.0,"taxApportionmentRate":null,"basisReductionPercentage":null,"exempt":null,"nonTaxable":null,"taxable":{"value":0.0,"unitOfMeasure":null},"reportingBasis":null,"imposition":{"value":"Sales and Use Tax","userDefined":null,"impositionId":1},"impositionType":{"value":"General Sales and Use","errorMessages":"null"} From the above I just wanted to show "effectRate":3.0 alone in the field Response, I don't want to show the other things. and sometimes in this Response there will be many effectRate.
... View more
- Tags:
- Reply
07-16-2020
06:35 AM
Hi , Thanks for your response, below is the sample for the multiple effectrate and sometimes it will be repeated 2 or 3 times and sometimes it will be only once. "TestResponse":null,"AABBCCDDDEEDDDoProcess": &&&&&&&&&&&,"effectrate":"1.0",Test""TESTPRocess_ID":*****,"effectiveDate":null,"expirationDate":null,"externalJurisdictionCode":null},"accumulate":null,"calculated":3.31,"effectrate":0.06625,"Rate":null,"basis":null,"exempt":null,"nonTaxable":null
... View more
- Tags:
- Reply
07-15-2020
04:49 PM
Hi Team, I have extracted a field which contains some response. From that response in that field I need only certain values to be displayed is it possible. For eg : The Response is below comes within a field called Response. Sometimes there will be multiple effectrate in the Response. Please advise. de":null,"AABBCCDDDEEDDDoProcess": &&&&&&&&&&&,"effectrate":1.0", "Test" From this I wanted to display only "effectrate:1.0" No Response 1 effectrate:1.0
... View more
Labels
- Labels:
-
field extraction
06-29-2020
04:44 PM
Hi Team, We are using confluence and we are planning to use our Splunk Dashboard URL as a RSS feed URL in Confluence. Could you please advise if the can I convert my Splunk Dashboard/Report URL into a RSS feed URL. If so please advise. Thanks !!!
... View more
Labels
- Labels:
-
other
06-20-2020
05:28 PM
Thanks a lot Rich 🙂
... View more
06-20-2020
04:28 PM
Hi Team, I am trying to extract the value after a particular string format and its not getting the right value. The Value i wanted is after this string "COUNT(1)=*" {ORD_CRTN_DTE=XXXXXXXX, COUNTRY=XXXXXX, AGENCY=XXXXXXX, PGM_CDE=XXXXXXX, COUNT(1)=1}] I am using the the below rex and its not giving the value of the count i.e 1. The Rex I am using is below. rex "COUNT(1)=(?<Count>\d+)"
... View more
Labels
- Labels:
-
other
04-30-2020
11:00 AM
Hi ,
thanks a lot -:)
... View more
04-29-2020
02:31 PM
hi,
here is my query
index="ereg-prod" source="/export/Apps/ereg-prod/batch/archive/.*log" | transaction time startswith="Start : Before Job" endswith="End : After Job" | rex field=source "ereg-prod/batch/archive/logs/job-(?\S+).log" | rex field=source "ereg-prod/batch/archive/logs/job-(?\S+).log" | chart avg(duration) as "Duration in Seconds" by BatchJobName
It is returning the results but the unable to format for HH:MM:SS which would be useful. Would it be possible to achieve that
... View more
04-29-2020
10:20 AM
Hi ,
Thanks , it does work . I too have another field which comes within the event and I am trying to calculate the duration by that field. My query is below
index="ereg-prod" | transaction time maxspan=1h startswith="Start : Before Job" endswith="End : After Job" | rex field=source "*/logs/job-(?\S+).log" | table duration, BatchJobName
basically I am trying to calculate the duration in HH/MM/SS for the batchjobs and there are some batch jobs which runs hourly and some every 15 min within a hour and how can arrive at the average running duration of these jobs. If I try my search | | chart values(duration) over _time by BatchJobName will it work. Any suggestions would be helpful.
... View more
04-28-2020
05:16 PM
I am trying to calculate the duration/timetaken between 2 strings in an event using transaction starts with and endswith and it is not giving the expected and the format is different, I wanted a simple format with HH:MM:SS
Example of event returned :
[main] 19:28:06,435[batchLogId=, clientCode=] INFO org.ets.ereg.batch.common.listener.BaseJobListener.beforeJob(BaseJobListener.java:89) - Start : Before Job *************
...
...
...
...
[main] 20:05:07,411[batchLogId=15304309, clientCode=] INFO org.ets.ereg.batch.common.listener.BaseJobListener.afterJob(BaseJobListener.java:163) - End : After Job ***********
My Requirement :
I wanted to calculate my time taken or duration based on the timings in front of these . Between Start and End After Job.
My Query is
index="ereg-prod" source="jobs.*log" | transaction startswith="Start : Before Job" endswith="End : After Job" | rex field=source "/*/logs/job-(?\S+).log"
I tried time chart and _time what is the exact way to get it. Any suggestions would be helpful.
... View more
- Tags:
- splunk-enterprise
Labels
- Labels:
-
transaction
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-19-2020
08:25 AM
|
