About dragon98902072

dragon98902072 · ‎07-08-2014

figured out a regex extraction that gives me what i need. see the below that will create 2 new fields root and app that can be used to group stats by either level. The following will take the total size files serverd and group by the second section of the URI (APP) cs_uri_stem=* sc_bytes>0 | rex field=cs_uri_stem "^/(?<root>.+?)/(?<app>.+?)/" | chart sum(sc_bytes) by app | top limit=25 sum(sc_bytes) by app

dragon98902072 · ‎07-08-2014

Hey all I have some IIS extractions that are pulling the field cs_uri_stem from my IIS 7.0-8.0 logs. I am trying to group stats and totals by common paths at the URI stem level. EX: applications/application1/* applications/application2/* However the full URI stem will all count differently even using folderize and dedup in my base search. I would like to ultimately limit this field to say 3 separators or /// that should get me my main application folder and collect all stats under this into the correct application root. Anyone have any ideas? Side note, My instance is the cloud version so i do not have access to transforms. Thanks

dragon98902072 · ‎02-03-2014

This is a bug in the Ping Federate app and version 6 of SPLUNK. I was told that Ping knows about this issue and are looking into a new compatible release first half of 2014 (Q1/Q2). The application does work with V5 of SPLUNK without issues. Hope this helps

Posts	3
Solutions	1
Karma Given	0
Karma Received	3
Member Since	‎02-03-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

extract URI_Stem and combine based on lowest path

Re: extract URI_Stem and combine based on lowest p...

extract URI_Stem and combine based on lowest path

Re: Error configuring PingFederate app