Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mplungjan
mplungjan
Path Finder
Member since:
05-02-2013
06-05-2020
Community Statistics
| Posts | 35 |
| Solutions | 1 |
| Karma Given | 7 |
| Karma Received | 0 |
| Member Since | 05-02-2013 |
Activity Feed
- Karma Re: How do I edit my search to remove specific substrings from URI values in my results? for javiergn. 06-05-2020 12:47 AM
- Karma Re: Field names specified in props.conf do not show in search app for kristian_kolb. 06-05-2020 12:46 AM
- Karma Re: Field names specified in props.conf do not show in search app for Ayn. 06-05-2020 12:46 AM
- Karma Re: Adding lookup from external csv to search for Ayn. 06-05-2020 12:46 AM
- Karma Re: Adding lookup from external csv to search for chris. 06-05-2020 12:46 AM
- Karma Re: Regex remove quotes from log file field for kristian_kolb. 06-05-2020 12:46 AM
- Karma tostring commas and locale specific separators for colinj. 06-05-2020 12:46 AM
- Posted Re: How do I edit my search to remove specific substrings from URI values in my results? on Splunk Search. 03-13-2018 07:08 AM
- Posted Re: How do I not show the value I do not want? on Splunk Search. 10-11-2013 12:59 AM
- Posted Re: How do I not show the value I do not want? on Splunk Search. 10-11-2013 12:26 AM
- Posted Re: How do I not show the value I do not want? on Splunk Search. 10-11-2013 12:17 AM
- Posted How do I not show the value I do not want? on Splunk Search. 10-10-2013 10:52 PM
- Tagged How do I not show the value I do not want? on Splunk Search. 10-10-2013 10:52 PM
- Posted Re: Regex remove quotes from log file field on Splunk Search. 09-11-2013 01:36 AM
- Posted Regex remove quotes from log file field on Splunk Search. 09-10-2013 08:03 AM
- Tagged Regex remove quotes from log file field on Splunk Search. 09-10-2013 08:03 AM
- Tagged Regex remove quotes from log file field on Splunk Search. 09-10-2013 08:03 AM
- Tagged Regex remove quotes from log file field on Splunk Search. 09-10-2013 08:03 AM
- Posted Re: tostring commas and locale specific separators on Splunk Search. 06-12-2013 05:44 AM
- Posted Re: Is splunk counting key/value in referer too? on Splunk Search. 06-12-2013 05:32 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-13-2018
07:08 AM
How to just ignore the ;jsessionid= ? Your code will only find records that DO have it, not the ones that do not have it
... View more
10-10-2013
10:52 PM
For an apache access log file with an extra field I have created a field extraction myfield - it works great.
I then want to extract all rows where this field is not equal to "-"
So I make a search
myfield !="-" | top limit=10000 myfield
And I still see "-" in the table
I even tried
myfield !="-" | top limit=10000 myfield | where myfield != "-"
Nope - still there. Since the vast majority of record have "-", all the rest have tiny colums.
What am I doing wrong and where in the documentation does it tell me what I had to do.
It is a bit like the useother=0
... View more
- Tags:
- field-extraction
09-10-2013
08:03 AM
Hi, I have a transform like this - it works fine except when I need to look up a field
[specialLogFile]
REGEX = ^([0-9\.]+) ([0-9\-]*) ([0-9\-]*) (\[[^\]]+\]) ("[^"]+") ([0-9\-]+) ([0-9\-]+) ("[^"]+") ("[^"]+") ([0-9\-]+) ("[^"]+") ([0-9\.]+)
FORMAT = client_ip::$1 user::$2 profile::$3 timestamp::$4 url::$5 http_status::$6 bytes::$7 referer::$8 user_agent::$9 processing_time_ms::$10 userNumber::$11 other_ip::$12
the matching log file entry would be
111.222.333.444 - - [24/Apr/2013:15:47:11 +0200] "GET /somerequest HTTP/1.1" 200 18356 "-" "some quoted useragent" 123 "4418" 222.333.444.555
My problem is when I want to use a look-up table with a userNumber, the CSV is converted by Splunk into a number, regardless of quotes in the CSV or not.
Can you please help me change ("[^"]+") to whatever it takes to become a non-quoted number so I can have a CSV with
userNumber email username
4418, someone@somewhere.com,Fred
and be able to match the userNumber from CSV to the extracted log file field at search time
Thanks
... View more
06-12-2013
05:44 AM
http://splunk-base.splunk.com/answers/10265/change-default-web-ui-locale
... View more
06-12-2013
05:32 AM
If I didn't I could imagine this would give false information sourcetype=access_*
|
transaction
clientip
startswith=eval(action="addtocart")
endswith=eval(action="purchase")
... View more
06-12-2013
05:21 AM
Thanks a lot. I think Splunk needs to mention that in the course materials
... View more
06-12-2013
05:20 AM
Does not seem to be in my Swiss German settings
... View more
06-12-2013
02:44 AM
Assuming I have an access log file with referer
If I have
111.111.111.111 - - [.......] "GET /cart.do?action=checkout&productId=prod1" "//..../searchresult"
111.111.111.111 - - [.......] "GET /cart.do?action=purchase&productId=prod2" "//..../cart.do?action=checkout&productId=prod1"
If I count productId will I get 2 and prod1 counted twice?
If I count action=checkout, do I get 2?
Can I make my search ignore the referer completely?
... View more
- Tags:
- search
06-03-2013
01:06 AM
AHA! : http://splunk-base.splunk.com/answers/931/how-do-i-prevent-splunk-from-launching-a-separate-cmd-window-on-windows-7-and-others
... View more
06-03-2013
12:59 AM
PS: On windows command > file.txt 2>&1 works in normal circumstances
... View more
06-03-2013
12:52 AM
Does not matter where I put the redirect on my win7 box. I get a popup, a fast scrolling set of data and the popup closes - Why does splunk make me feel like I haven't been around computers since 1986!?
... View more
06-02-2013
11:42 PM
thanks again. Just tried this. I cannot seem to capture the output no matter what I do $SPLUNK_HOME/bin/splunk cmd btool props list --debug > splunk.txt 2>&1 or whatever
... View more
05-24-2013
07:32 AM
Yes, thanks - I realise that. the problem is finding the "somewhere" since it is not in any file so it must be in some cached setting.
... View more
05-24-2013
07:26 AM
Thanks @chris - I'll check it after my vacation. The command line thing is very interesting seeing how hard it seems to get debug information - and the whole issue here is that the fields are only recognised if I do a | rex
"^my regex"
... View more
05-23-2013
12:38 PM
Thank. I did read that page from end to end and that is how I uploaded the lookup. What I fail to grasp is the next step. Since my automatic extraction didn't work, the automatic use of lookup also did not work, now I am trying to test the thing with your suggested Rex and that finally started to work, but the lookup seems so unnecessary complicated - as does many things in splunk. Powerful but opaque. I will try again tomorrow. Thanks for the persistent assistance
... View more
05-23-2013
09:07 AM
I would like to do this permanently but let us try it on the command line first.
command:
source="C:\\..." | rex "^(?<client_ip>[0-9\.]+) (?<user>[0-9\-]*) (?<profile>[0-9\-]*) (?<timestamp>\[[^\]]+\]) (?<url>\"[^\"]+\") (?<http_status>[0-9\-]+) (?<bytes>[0-9\-]+) (\"[^\"]+\") (?<user_agent>\"[^\"]+\") (?<processing_time>[0-9\-]+) (?<registrant>\"[^\"]+\") (?<forward_for>[0-9\.\-]+)" | lookup registrant.csv registrant
input, apache custom log
1.1.1.1 - - [24/Apr/2013:16:10:08 +0200] "GET /someurl HTTP/1.1" 200 278356 "-" "some useragent" 123 "9999" 111.222.333.444
Lookup file:
registrant,fullname
9999,John Doe
7777,Jane Doe
where do I save registrant.csv? I put it in \etc\apps\search\local and \etc\system\lookups
where would I see John Doe in the output if the above worked?
UPDATE
So I tried the suggestion given.
In etc\system\lookups\registrants.csv I have
applicationid,username,email
0,Anonymous,
1234,John Doe,johndoe@xxx.com
4321,Jane Doe,janedoe@xxx.com
in \etc\system\local\props.conf I have
[registrants]
EXTRACT-fields=^(?<client_ip>[0-9\.]+) (?<user>[0-9\-]*) (?<profile>[0-9\-]*) (?<timestamp>\[[^\]]+\]) (?<url>\"[^\"]+\") (?<http_status>[0-9\-]+) (?<bytes>[0-9\-]+) (\"[^\"]+\") (?<user_agent>\"[^\"]+\") (?<processing_time>[0-9\-]+) (?<applicationid>\"[^\"]+\") (?<forward_for>[0-9\.\-]+)
LOOKUP-applicationid=registrants username
in \etc\system\local\transforms.conf I have
[registrants]
filename = registrants.csv
I am now getting error on all searches: The lookup table 'registrant' does not exist. It is referenced by configuration 'combined_wcookie'. which I have no idea how to get rid of :(((
UPDATE
The documentation is not clear. It uses the same names for the source file fields and the csv.
I am now a bit further - one issue is that the csv is forced by splunk to be numeric values since the field I am testing happens to be a number. In the log file it is a string so I have to extract it without quotes.
I now extract ONE (1) record out of many. It is not encouraging...
... View more
05-23-2013
04:34 AM
Your regex has the user agent in the record extracted into processing_time_ms, your registrant holds the processing time and the forward_for holds the registrant - we are so close I can taste it 😮
... View more
05-23-2013
04:30 AM
Next thing is to look up the registrant in a look up table. Can I do that when I am using an inline REX ?
... View more
05-23-2013
04:28 AM
I understand. It is frustrating. I added (\"[^\"]+\") and in front of the user agent and it stopped showing the field names. It did show data, just the fieldnames disappeared from the list on the left
... View more
