Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About 3618475
3618475
Engager
Member since:
05-21-2020
06-05-2020
Community Statistics
| Posts | 10 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 05-21-2020 |
Activity Feed
- Karma Re: Error when trying to add token to limit table results in a search? for richgalloway. 06-05-2020 12:51 AM
- Posted Re: How to filter table results based on an aggregation of a column on Splunk Search. 06-03-2020 04:42 AM
- Posted How to filter table results based on an aggregation of a column on Splunk Search. 06-02-2020 02:07 PM
- Tagged How to filter table results based on an aggregation of a column on Splunk Search. 06-02-2020 02:07 PM
- Tagged How to filter table results based on an aggregation of a column on Splunk Search. 06-02-2020 02:07 PM
- Tagged How to filter table results based on an aggregation of a column on Splunk Search. 06-02-2020 02:07 PM
- Posted Re: Error when trying to add token to limit table results in a search? on Splunk Search. 06-02-2020 12:55 PM
- Posted Re: Error when trying to add token to limit table results in a search? on Splunk Search. 06-02-2020 11:29 AM
- Posted Error when trying to add token to limit table results in a search? on Splunk Search. 06-02-2020 09:05 AM
- Tagged Error when trying to add token to limit table results in a search? on Splunk Search. 06-02-2020 09:05 AM
- Tagged Error when trying to add token to limit table results in a search? on Splunk Search. 06-02-2020 09:05 AM
- Tagged Error when trying to add token to limit table results in a search? on Splunk Search. 06-02-2020 09:05 AM
- Tagged Error when trying to add token to limit table results in a search? on Splunk Search. 06-02-2020 09:05 AM
- Tagged Error when trying to add token to limit table results in a search? on Splunk Search. 06-02-2020 09:05 AM
- Posted Re: How to use input data to filter data displayed on a table in a dashboard? on Dashboards & Visualizations. 05-30-2020 09:26 AM
- Posted How to use input data to filter data displayed on a table in a dashboard? on Dashboards & Visualizations. 05-29-2020 02:57 PM
- Tagged How to use input data to filter data displayed on a table in a dashboard? on Dashboards & Visualizations. 05-29-2020 02:57 PM
- Tagged How to use input data to filter data displayed on a table in a dashboard? on Dashboards & Visualizations. 05-29-2020 02:57 PM
- Tagged How to use input data to filter data displayed on a table in a dashboard? on Dashboards & Visualizations. 05-29-2020 02:57 PM
- Posted Can a group be defined based on a list of variables on Splunk Search. 05-28-2020 05:57 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-03-2020
04:42 AM
Thanks for your help.
I was not clear enough in my question.
I want the final output to be the table filtered on Segments of 2 or 3.
If the segments were filtered by Segments = 2, the output should look like the table columns above but with only 2 Segments.
Since the stats command reduces the fields, I probably cant use it
... View more
06-02-2020
02:07 PM
I have this search that produces a table with has a column that lists the number of segments to a schedule. The table is shown below
I want to filter on the maximum number of segments (either 2 or 3). This is the query:
...search | table purchCostReference, eventType, Time, Segments, Carriers, BillingMethod, Origin, Destination, StopOffLocation | stats max(Segments) as TotalSegments by purchCostReference, eventType | search TotalSegments = 2 |sort Time
I can use the max method to get the maximum number of segments and use the where to filter on the number of segments that I need but not all of the data is returned, only the columns that I used for the max function and I don't want the column TotalSegments displayed.
I want to return only the rows that have 2 segments and not have an additional column of TotalSegments.
... View more
06-02-2020
12:55 PM
In my case I just had to add "$purchCostReferenceToken$" to the query
... View more
06-02-2020
11:29 AM
Thanks! That worked
... View more
06-02-2020
09:05 AM
I recreated the dashboard using the report search and have the search returning all of the table results. I have an input for the reference number as a text box. The token name is: purchCostReferenceToken
I want to limit the table results based on this token. This is the search:
<form>
<label>Thru Train Dashboard</label>
<fieldset submitButton="false" autoRun="true">
<input type="text" token="purchCostReferenceToken" searchWhenChanged="true">
<label>Enter a TMS Reference Number to Filter Table</label>
<default>*</default>
<initialValue>*</initialValue>
</input>
</fieldset>
<row>
<panel>
<title>Thru Train Data</title>
<table>
<search>
<query>index=... "<billingMethod>RULE</billingMethod>" "createMessage MsgSource" | xmlkv | rex max_match=0 "\<purchasedCostTripSegment\>(?P<segment>[^\<]+)" |eval Segments = mvrange(1,mvcount(mvindex(segment, 0, 2))+1,1) | rex max_match=0 "\<carrier\>(?P<Carriers>[^\<]+)" | rex max_match=0 "\<billingMethod\>(?P<BillingMethod>[^\<]+)" | rex max_match=0 "<purchasedCostTripSegment>[\s\S]*?<origin>\s*<ns2:numberCode>(?P<Origin>\d+)" | rex max_match=0 "<purchasedCostTripSegment>[\s\S]*?<destination>\s*<ns2:numberCode>(?P<Destination>\d+)" | rex max_match=0 "<purchasedCostTripSegment>[\s\S]*?<stopOff>\s*<ns2:stopOffLocation>\s*<ns2:numberCode>(?P<StopOffLocation>\d+)" | eval Time =_time | convert timeformat="%m-%d-%Y %H:%M:%S" ctime(Time) | table purchCostReference, eventType, Time, Segments, Carriers, BillingMethod, Origin, Destination, StopOffLocation | sort Time</query>
<earliest>-30d@d</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</form>
Where do I add the token to limit the search? I tried adding this to the end of the search before the table command:
... | eval Time =_time | convert timeformat="%m-%d-%Y %H:%M:%S" ctime(Time) purchCostReference=$purchCostReferenceToken$ | table purchCostReference, eventType, Time, Segments, Carriers, BillingMethod, Origin, Destination, StopOffLocation | sort Time
I get an error...error in convert command: the argument purchCostReference- is invalid I would like to add filters in several of the table columns. The purchCostReference value is an extracted field in the search using xmlkv
... View more
05-30-2020
09:26 AM
I don't see how I can edit my question.
... View more
05-29-2020
02:57 PM
I created a dashboard using a report. The report creates a table of data. The filter would be a text box for purchCostReference . This is a screenshot of the table:
I don't understand how to connect the inputs to the table data. The text box will be an input and when entered will filter the table data using the column purchCostReference. This is the current xml
<form>
<label>Thru Train Dashboard</label>
<fieldset submitButton="false" autoRun="true">
<input type="text" token="purchCostReferenceToken" searchWhenChanged="true">
<label>TMS Reference Number</label>
<default>*</default>
<initialValue>*</initialValue>
</input>
</fieldset>
<row>
<panel>
<title>Thru Train XML DATA</title>
<table>
<search ref="ThruTrainReportNestedResults"></search>
<option name="drilldown">row</option>
<option name="rowNumbers">true</option>
</table>
</panel>
</row>
</form>
The current report does not take parameters to filter the data. I would like to add filters to the report but do not understand how to do that. Is there a way to use the data that is displayed on the current dashboard and filter that data without changing the report? How do I add parameters to filter the data?
... View more
Labels
- Labels:
-
table
05-28-2020
05:57 PM
I have an xml file in a logging statement that I extracted 3 instances of the value . These values are correctly displayed in a table in separate columns. The xml file will have 2 or 3 instances of the value: **** This is the query:
source="messaging-service.log" sourcetype="hidden" "createMessage MsgSource" | xmlkv | rex max_match=0 "\<purchCostReference\>(?P<segment>[^\<]+)" | eval Segment1 = if(isnotnull(mvindex(segment, 0)), "FirstSegment", ""), Segment2 = if(isnotnull(mvindex(segment, 1)), "SecondSegment", ""), Segment3 = if(isnotnull(mvindex(segment, 2)), "ThirdSegment", "") | table purchCostReference, eventType, Segment1, Segment2, Segment3
I tried using the case statement but it only returns the first value, FirstSegment in the table.
sourcetype... | xmlkv | rex max_match=0 "\<purchCostReference\>(?P<segment>[^\<]+)" | eval Segments = case(isnotnull(mvindex(segment, 0)), "FirstSegment", isnotnull(mvindex(segment, 1)), "SecondSegment", isnotnull(mvindex(segment, 2)), "ThirdSegment") | table purchCostReference, eventType, Segments | eventstats list(Segments) as Segments by purchCostReference, eventType | sort purchCostReference, eventType
I would like there to be 1 column, Segment and the FirstSegment, SecondSegment, ThirdSegment be listed in the column. Is there any Splunk function that allows me to create a group called 'Segment' and add the variables, FirstSegment, SecondSegment, ThirdSegment to it?
... View more
Labels
- Labels:
-
eval
-
field extraction
-
table
05-22-2020
12:23 PM
I have a huge XML file with many tiers. I use this command to limit the number of events for the XML data that I want to extract, then I use xmlkv to extract the XML fields. The fields that I need are extracted but not all of the data is pulled.
This is the command:
index=83261 source="service.log" sourcetype="dispatchapp" "RULE" "createMessage MsgSource" | xmlkv
This is a partial example of the XML file:
PURCHASEDLINEHAUL DISPATCH 2020-05-21T17:22:55.000Z
<ns2:numberCode>923</ns2:numberCode>
<ns2:numberType>2</ns2:numberType> </origin> <destination>
<ns2:numberCode>72</ns2:numberCode>
<ns2:numberType>2</ns2:numberType> </destination>
<purchasedCost>
<purchasedCostTripSegment>
<purchCostReference>1587040</purchCostReference>
<carrier>FXTR</carrier>
<vendorType>DRAY</vendorType>
<carrierTrailerType>PZ1</carrierTrailerType>
<origin>
<ns2:numberCode>923</ns2:numberCode>
</origin>
<destination>
<ns2:numberCode>4022</ns2:numberCode>
</destination>
</purchasedCostTripSegment>
<purchasedCostTripSegment>
<purchCostReference>1587040</purchCostReference>
<carrier>BNSF</carrier>
<vendorType>RAIL</vendorType>
<carrierTrailerType>PZ1</carrierTrailerType>
<origin>
<ns2:numberCode>4022</ns2:numberCode>
</origin>
<destination>
<ns2:numberCode>4040</ns2:numberCode>
</destination>
</purchasedCostTripSegment>
<purchasedCostTripSegment>
<purchCostReference>1587040</purchCostReference>
<carrier>NS</carrier>
<vendorType>RAIL</vendorType>
<carrierTrailerType>PZ1</carrierTrailerType>
<origin>
<ns2:numberCode>4061</ns2:numberCode>
</origin>
<destination>
<ns2:numberCode>4040</ns2:numberCode>
</destination>
</purchasedCostTripSegment> </purchasedCost>
This image shows that the ns:numberCode is extracted buy only 3 but there are 5 instances in the view above. But the entire xml there are many more.
How can I get the rest of the instances in the field extraction, and how can I identify the path where these values are coming from in the XML?
... View more
05-21-2020
09:14 AM
I am using Splunk to extract a number of fields from xml data this is contained in a log file.
The file is very large. This is part of it.
xmlns:ns2="http://ground.fedex.com/schemas/linehaul/TMSCommon">
PURCHASEDLINEHAUL
APPROVE
116029927
104257037
104257037
1
2020-02-20T21:53:39.000Z
.... more lines here that are not important
1587040
FXTR
DRAY
RULE
PZ1
923
RLTO
330 RESOURCE DRIVE
LH PHONE 877-851-3543
true
This query selects the xml part text in the logging file and some of the fields are extracted and I can add to a table. (not including the source and sourcetype..)
| xmlkv | table purchCostReference, eventType, carrier, billingMethod
But need more fields that are child elements within the xml data. One of them is the numberCode. I am trying to use xpath to extract these additional fields.
| xmlkv | xpath
"//tmsTrip/purchasedCost/purchasedCostTripSegment/origin/ns2:numberCode"
outfield=Origin | table
purchCostReference, eventType,
carrier, billingMethod, Origin
But no Origin data is returned when I add the field to the table. There is no error. The Origin column is empty.
What am I doing wrong with the xpath command that it is not showing any data?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
