About raghul725

raghul725 · ‎06-12-2020

Yes I tried your test query it works And tried it immediately without time after @& I thought it would work and it did. OK now, If I run the query against my logs using search i.e. by not passing the log lines via the query, I see 31 events for yesterday, but statistics (0). As usual if I remove "by reptype", returns the count as 31 under statistics.

raghul725 · ‎06-12-2020

I see what the confusion could be. Sorry I should have been clear. When I said File successfully sent - AllOpenItemsPT_YYYYMMDD_HR-MM.csv.zip @08:00 File successfully sent - AllOpenItemsPT_YYYYMMDD_HR-MM.csv.zip @10:15 File successfully sent - AllOpenItemsPT_YYYYMMDD_HR-MM.csv.zip @11:00 The time after @ is not in the logs, that was just an example stating it runs around that time. So to put it simply the logs would like File successfully sent - AllOpenItemsPT_YYYYMMDD_HR-MM.csv.zip Would your suggestion still work please?

raghul725 · ‎06-12-2020

Hello Again, As soon as I group "by reptype", no events are returned. Any other suggestions please?

raghul725 · ‎06-11-2020

Sure, Group by file name without date&time (Example - AllOpenItemsPT, AllOpenItemsMaint etc) and display the count. But thinking about it, it may be useful to display the date&time as well, but then my previous group by won't work

raghul725 · ‎06-11-2020

Thanks Thanks, But as soon as I add "by epoch", search says no event returned. I guess group by epoch does apply here, because epoch is defined by - %Y%M%D_%H-%M" And none of the files can be grouped based on that?

raghul725 · ‎06-11-2020

Sure, Group by file name without date&time (Example - AllOpenItemsPT, AllOpenItemsMaint etc) and display the count. But thinking about it, it may be useful to display the date&time as well, but then my previous group by won't work

raghul725 · ‎06-11-2020

Hello, I have the following logs from Cron File successfully sent - AllOpenItemsPT_YYYYMMDD_HR-MM.csv.zip @08:00 File successfully sent - AllOpenItemsPT_YYYYMMDD_HR-MM.csv.zip @10:15 File successfully sent - AllOpenItemsPT_YYYYMMDD_HR-MM.csv.zip @11:00 File successfully sent - AllOpenItemsMaint_YYYYMMDD_HR-MM.csv.zip @07:00 File successfully sent - AllOpenItemsMaint_YYYYMMDD_HR-MM.csv.zip @09:00 File successfully sent - AllOpenItemsMaint_YYYYMMDD_HR-MM.csv.zip @13:00 File successfully sent - AllOpenItemsCOUNTRYNAME_YYYYMMDD_HR-MM.csv.zip @12:00 File successfully sent - AllOpenItemsCOUNTRYNAME_YYYYMMDD_HR-MM.csv.zip @14:30 File successfully sent - AllOpenItemsCOUNTRYNAME_YYYYMMDD_HR-MM.csv.zip @17:20 I am trying to group the files based on "AllOpenItems" string for last 24 hours and tried the below. index=* namespace=* "File successfully sent -"| rex "File successfully sent - AllOpenItems(?<reptype>\w+)"|stats values(reptype) as ReportType by reptype The problem with the above is, I am unable to strip the Date&time the file name, so it won't group as per my requirement. Could someone assist please?

raghul725 · ‎06-03-2020

brilliant thanks

raghul725 · ‎06-03-2020

So essentially, what we are saying here is Alert Expire field defines how long the alert will be visible, once triggered and does NOT set an expiry on the alert trigger i.e. alter trigger will be enabled until that is disabled manually.

raghul725 · ‎06-03-2020

Hello All, Sorry to ask a silly question, I had a look around, but unable to find a solution. When we set an alert in Splunk, there is an Expires Parameter. I understand this is TTL for the Alert (Sorry if I have misunderstood it). I don't want my Alert to Expire. How can I achieve this please? If there is no means to achieve this, is there a way to trigger a notification, when that alert is about to expire please? I tried couple of options in alert setting, to see if splunk triggers a notification when an alert expires, I am afraid no notification was triggered. For example set "Trigger Condition", "Trigger Time" and set the alert to Expire in 10 mins. The alert Expired but no notification was triggered via email. I had a feeling it won't work, as Trigger Condition means - The condition that triggers the alert and NOT alert expiry - but just tried my luck! Best Regards,

raghul725 · ‎05-23-2020

Nice thanks Richgalloway, Regex works, but for some reason searchmatch does not return any results. Anyways I can survive with Regex. Best Regards,

raghul725 · ‎05-23-2020

Hello, I have the following lines in logs [Kafka Server 4], shut down completed (kafka.server) [Kafka Server 4], start completed (kafka.server) The number before ] could be anything between 0-9 So I am trying the following index=* namespace=XXXXXX | search ["Kafka Server"\s\d]\,\ss\w+ And I am expecting the result to be [Kafka Server 4], shut [Kafka Server 4], start But I am not getting the desired result While I try index=* namespace=XXXXXX | search ["Kafka Server" I get [Kafka Server 4], shut down completed (kafka.server) [Kafka Server 4], start completed (kafka.server) [Kafka Server 5], shut down completed (kafka.server) [Kafka Server 6], start completed (kafka.server) ...... etc Could someone assist me please? Regards

Posts	12
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎05-20-2020

Online Status	Offline
Date Last Visited	‎06-12-2020 07:05 AM

Strip datetime and group by filename

Don't Expire Alerts

search string containing alphanumeric characters a...

Re: Strip datetime and group by filename

Re: Strip datetime and group by filename

Re: Strip datetime and group by filename

Re: Strip datetime and group by filename

Re: Strip datetime and group by filename

Re: Strip datetime and group by filename

Strip datetime and group by filename

Re: Don't Expire Alerts

Re: Don't Expire Alerts

Don't Expire Alerts

Re: search string containing alphanumeric characte...

search string containing alphanumeric characters a...