About NeonFlash

NeonFlash · ‎01-09-2013

I am querying a sourcetype which has a field called _time that displays the timestamp of the event. The format of this field is: 1/9/13 10:10:53.000 AM Now, I want to display the minimum and maximum timestamps in the entire column. I tried using the min and max functions however it does not give any output. table min(_time), max(_time) This way I would get the first instance and the last instance of the event from the logs. I even tried to use the eval function as follows: table eval(min(_time)), eval(max(_time))

NeonFlash · ‎11-26-2012

Hi, I want to know the difference between the following 2 searches: sourcetype="source" search NOT field2=*keyword* | table field1, field2, field3 and sourcetype="source" | table field1, field2, field3 | search NOT field2=*keyword* I am not getting all the relevant results with the first search query. What I am trying to do is: I want to reduce the number of results returned by the sourcetype and later process them by piping the output to a regex. the second splunk query takes a longer time to execute because it will at first extract all the results from the sourcetype and then apply a filter on field2. I want to reduce the number of results extracted from the sourcetype itself while running the query to reduce the execution time of query. something like in SQL: select * from table where column_name LIKE '%keyword%' so, here I have reduced the results returned by SQL query itself which can later be processed by piping the output to another expression.

NeonFlash · ‎07-26-2012

Hi, yes, the regex worked. For some reason when I ran the splunk query for the first time, it did not work. Yes, I escaped the metacharacter with a backslash. @Ayn: In my case the field name is different 🙂

NeonFlash · ‎07-25-2012

I want to list all the file names in a log file in Splunk whose name ends with, "_bn.txt" Let's say the field name is path so my regex looks like regex path=".*_bn.txt$" However, this does not list down the results. But if I use the following regex: regex path=".*.txt$" I am able to see all the filenames which end in .txt. Need to find all the file names ending in, _bn.txt Thanks. PS: I don't think underscore is a metacharacter which needs to be escaped.

NeonFlash · ‎05-19-2012

Thanks. An exact match would be, "^/[a-zA-Z0-9]{8}/welcome.html$" However, this would also match something like /shopping/welcome.html, /politics/welcome.html. Can the regex be modified even further so that it looks for a format which has at least 1 or more character from each Charset, [a-z][A-Z][0-9]. I need to match it in such a way that it has at least 1 or more character from each Character Classes.

NeonFlash · ‎05-18-2012

I want to view all the HTTP GET Requests in the Proxy Logs to any website of the following format: http://example.com/<format>/welcome.html here, is as follows: It consists of a total of 8 characters which may include numbers (0-9), alphabets both, lowercase and upper case (a-z, A-Z) few examples: /HXut2jHC/welcome.html /mK151WbA/welcome.html /gMsyk6kT/welcome.html My Splunk Search is as following: sourcetype="bcoat_proxysg" | rex field=uri_path "(?uri_path between angle brackets /^[a-zA-Z0-9]{8}/welcome.html$)" here, uri_path is the field in Proxy Logs which will contain the URI Path to which the HTTP Request was sent. However, this does not seem to work. I think I need to include more conditions in the Regex like: The format string should appear between the first and second forward slash of the GET Request followed by welcome.html. Note: Why am I not able to write text between angle brackets? Thanks.

NeonFlash · ‎02-04-2012

I am parsing the Blue Coat Proxys logs using Splunk Queries. For an ip address, xxx.xxx.xxx.xxx, I am interested in viewing all the sites they visited for the past 7 days. However, I want to view only the Main Domains in the results. To make it more clear, I want to group the results like following: Right now my search which looks something like this: sourcetype="bcoat_proxysg" | table _time, dest_host, http_method, uri_path, uri_query | stats count by dest_host It will show all the dest_host unique entries. It looks like this: a1.apple.com - 21 a2.apple.com - 10 a3.apple.com - 15 and so on. I want to group the results by main domain like apple.com and the count now should say the sum of all (21+10+15) instead. Something like: apple.com - 46 How do I go about doing this in Splunk? Does this require some regular expression to be able to do it? Thanks.

NeonFlash · ‎02-04-2012

Hi, I am parsing the DNS logs in Splunk and in order to refine my search results, I use something like following. For an IP Address: xxx.xxx.xxx.xxx, which sends DNS queries for a host at some point of time, I would like to view the list of all the different hosts queried. So, my splunk search is: xxx.xxx.xxx.xxx sourcetype="dns" | table _time, query There are many results where I have entries of subdomains of yyy.com and zzz.com which I want to filter out. I can write something like following for excluding just one of the domains from results like: xxx.xxx.xxx.xxx sourcetype="dns" query!="yyy" | table _time, query Now, 2 questions: How do I do this for 2 or more domains which I would like to exclude? Is there an option to use an AND or OR operator? How do I display only the unique query entries in the results? I know we can use the below search to display all unique query entries and a count of them: xxx.xxx.xxx.xxx sourcetype="dns" query!="yyy" | table _time, query | stats count by query But this way, the _time column is not shown in the results which I would definitely not want to omit from the results. Thanks.

Posts	8
Solutions	0
Karma Given	2
Karma Received	4
Member Since	‎02-04-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Display Minimum and Maximum values in a Column

Splunk Search Syntax

Splunk Regex Question

Regex Question for Proxy Logs

Group results by Main Domains in Splunk Proxy Log ...

Exclude filter for multiple strings in Queries