| rex "\(stories\)\s\((?<stories>[^\)]+)\)" ... View more

Hi, Please verify your indexes.conf whether datatype is missed for index "itsi_summary_metrics". Else try to import indexes from your ITSI SearchHead. This need to be taken care when you upgrade from 4.4.x to 4.7.x [itsi_summary_metrics] homePath = $SPLUNK_DB/itsi_summary_metrics/db coldPath = $SPLUNK_DB/cold/itsi_summary_metrics/colddb thawedPath = $SPLUNK_DB/itsi_summary_metrics/thaweddb datatype=metric ... View more

What is wrong with what @daisy_st  suggested? One reason it might not be working is that the information you provided is not your actual raw event. If that is the case, please provide some real examples. Another possibility is that you are not looking for search time / SPL extraction but you want to know how to extract this at indexing time. Please can you clarify? ... View more

Hi There, \/(?P<locale>[^\/]+)\/klarna Or within the Splunk search itself:   |rex field= ##INSERT RELEVANT FIELDNAME## "\/(?P<locale>[^\/]+)\/klarna" ... View more

To list the Glass Table Keys and Title you can use:    | rest /servicesNS/-/-/itoa_interface/glass_table report_as=text fields="_key,title" | eval value=spath(value,"{}") | mvexpand value | eval glass_table_id=spath(value, "_key"), glass_table_title=spath(value, "title") | fields - value   ... View more

Like this: | makeresults | eval _raw="ACC - 127.0.0.1 - - [27/Nov/2019:15:34:47 +0100] \"GET /ja_jp/checkout/orderConfirmation/12598099392 HTTP/1.0\" 302 - \"https://secureacceptance.cybersource.com/\" \"targetapp_ios_12_Mozilla/5.0 (iPad; CPU OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148\" J=F1291B21689EBBBAC9C3864AFAC9FDCD17AE26C9BC04183F079014FC7A9FCC0CE892C995CA283C7033F54B4B236B8DC5AA9B3F85A7B8E567E75430C49D075418.hybris-ecommerce-59dc4956fb-868d9 TimeMillToProcess=492 TimeMillToCommit=492" | kv | rex "GET (?<URL>\S+)" | rex field=URL "(?<account>\d+)" ... View more

@szhou_splunk we have performed the same suggested by you,but unfortunately it didnt work . please help here . ... View more

Assuming the field you're searching in is named "host" this may work: (your search) | rex field=host "(PRD|prd)(?<instance>\w{2,3})" See https://regex101.com/r/LlINs6/2 ... View more

Hi @Hemant1, I didnt understand your question, maybe if you put it in a text it would be easier. But I took a shot at improving your search, try this : index=vmware* (sourcetype=vmware:perf:cpu OR sourcetype=vmware:perf:mem) source=*virtual* |bin span=5m _time | stats avg(p_average_cpu_usage_percent) as "cpuUsage", avg(p_average_mem_usage_percent) as "memUsage" by moid,host,_time | lookup Entity moid AS moid, host AS host OUTPUTNEW lowername | stats count(eval(cpuUsage>=85 AND cpuUsage<90 )) as "OverThresholdCpu", count(cpuUsage) as "TotalCountCpu",count(eval(memUsage>=85 AND memUsage<90)) as "OverThresholdMem", count(memUsage) as "TotalCountMem" ,count(eval(cpuUsage>=90)) as "OverThresholdCpu90" ,count(eval(memUsage>=90)) as "OverThresholdMem90" by lowername,host |eval procentOverMem=if(OverThresholdMem>=2,1,0) |eval procentOverMem90=if(OverThresholdMem90>=2,1,0) |eval procentOverCpu90=if(OverThresholdCpu90>=2,1,0) |eval procentOverCpu=if(OverThresholdCpu>=2,1,0) | rename lowername as hostName Also depending if you are okay with running the lookup on the host without the moid field only then this will even run faster : index=vmware* (sourcetype=vmware:perf:cpu OR sourcetype=vmware:perf:mem) source=*virtual* |bin span=5m _time | stats avg(p_average_cpu_usage_percent) as "cpuUsage", avg(p_average_mem_usage_percent) as "memUsage" by host,_time | stats count(eval(cpuUsage>=85 AND cpuUsage<90 )) as "OverThresholdCpu", count(cpuUsage) as "TotalCountCpu",count(eval(memUsage>=85 AND memUsage<90)) as "OverThresholdMem", count(memUsage) as "TotalCountMem" ,count(eval(cpuUsage>=90)) as "OverThresholdCpu90" ,count(eval(memUsage>=90)) as "OverThresholdMem90" by host | lookup Entity host OUTPUTNEW lowername |eval procentOverMem=if(OverThresholdMem>=2,1,0) |eval procentOverMem90=if(OverThresholdMem90>=2,1,0) |eval procentOverCpu90=if(OverThresholdCpu90>=2,1,0) |eval procentOverCpu=if(OverThresholdCpu>=2,1,0) | rename lowername as hostName Let me know if that helps please provide some text explanation (not in the title) so I can help you make it even better. Cheers, David ... View more

thank you so much ... View more

You have the good approach stats command to measure the first(_time) and last(_time) to then measure the duration or use the transaction command https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction ... View more

You can use a sub search to call the lookup and return an OR condition , to use as a search condition. <my search> [ | inputlookup mylookup | table A ] will become <mysearch> A=x OR A=y OR A=z for more complex conditions, look at the command format https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Format ... View more

Hi, @Hemant1 maybe you hit the limit of max of 50K records returned by subsearch, we can change the limit in limits.conf but I encourage you not using join command here , maybe you can use "*stats ... by UserID" instead. You can also refer to https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html. ... View more

I cannot understand what you are asking. Perhaps have a colleague review the words that you are using and re-edit to add clarity. ... View more