Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Supriya
Supriya
Path Finder
Member since:
08-06-2020
07-15-2022
Community Statistics
| Posts | 40 |
| Solutions | 1 |
| Karma Given | 9 |
| Karma Received | 3 |
| Member Since | 08-06-2020 |
Activity Feed
- Got Karma for Re: rex for complex data. 10-12-2021 05:53 AM
- Posted Re: rex for complex data on Other Usage. 10-05-2021 11:30 PM
- Posted Re: output csv file is splitting in different rows on Splunk Search. 10-05-2021 11:00 AM
- Posted Re: export long term row in csv on Other Usage. 10-05-2021 10:34 AM
- Posted output csv file is splitting in different rows on Splunk Search. 10-05-2021 10:28 AM
- Tagged output csv file is splitting in different rows on Splunk Search. 10-05-2021 10:28 AM
- Tagged output csv file is splitting in different rows on Splunk Search. 10-05-2021 10:28 AM
- Tagged output csv file is splitting in different rows on Splunk Search. 10-05-2021 10:28 AM
- Tagged output csv file is splitting in different rows on Splunk Search. 10-05-2021 10:28 AM
- Posted Re: field extraction for the complex data on Other Usage. 10-05-2021 06:40 AM
- Posted Re: field extraction for the complex data on Other Usage. 10-05-2021 04:44 AM
- Posted Re: rex for complex data on Other Usage. 10-05-2021 04:31 AM
- Karma Re: rex for complex data for cpetterborg. 10-05-2021 04:25 AM
- Posted rex for complex data on Other Usage. 10-04-2021 10:39 AM
- Tagged rex for complex data on Other Usage. 10-04-2021 10:39 AM
- Tagged rex for complex data on Other Usage. 10-04-2021 10:39 AM
- Tagged rex for complex data on Other Usage. 10-04-2021 10:39 AM
- Tagged rex for complex data on Other Usage. 10-04-2021 10:39 AM
- Posted field extraction for the complex data on Other Usage. 10-04-2021 10:32 AM
- Tagged field extraction for the complex data on Other Usage. 10-04-2021 10:32 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
10-05-2021
11:30 PM
Hi @cpetterborg , In splunk cloud I have 500+ events and each event contains 100+ lines of data. while exporting in CSV file single event is splitting in different rows which should not happen. I need the data same as the splunk results row wise without splitting Is there an limitation per single row while exporting in csv file? Here is the screenshot for reference, where 2nd and 3rd rows are single event(but splitted in 2 rows) and 5&6 single event and 8&9 single event, data from 4th and 7th row is fine
... View more
10-05-2021
10:34 AM
@gibba I'm facing similar issue could you help me how it can be resolved?
... View more
10-05-2021
10:28 AM
Hi , Could someone help me with the below issue In splunk cloud I have 500+ events and each event contains 100+ lines of data. while exporting in CSV file single event is splitting in different rows which should not happen. I need the data same as the splunk results row wise without splitting Is there an limitation per single row while exporting in csv file? Here is the screenshot for reference, where 2nd and 3rd rows are single event(but splitted in 2 rows) and 5&6 single event and 8&9 single event, data from 4th and 7th row is fine
... View more
10-05-2021
06:40 AM
thank you for explaining and accepted your solution Here one more issue I have is while downloading these results in CSV file, the column statement_text is splitting in different rows. could you help me with this issue @ITWhisperer
... View more
10-05-2021
04:31 AM
1 Karma
Thank you everyone for your inputs! Out of all only the below rex is working for my data, thank you @cpetterborg |rex field=_raw "statement_text\=\"(?<statement_text>[\s\S]+)\",\s*cnt=\"" Here one more issue I have is while downloading the results in CSV file, the column statement_text is splitting in different rows. could you help me with this issue
... View more
10-04-2021
10:39 AM
Hi Team, Could someone help me with the field extraction for the below complex data(1000 lines of data I concised to 10 lines of data ) : columns to be extracted are statement_text , cnt, total_reads, total_writes, db_name statement_text="insert into #pt_queryhistory_time ( [sample_time],command_id,cnt,total_time,[db_name],sqlhandle,hash_char) select top 500 [sample_time] = convert(smalldatetime,'2021-09-27 18:55:00'), total_time = qs.total_elapsed_time/1000, avg_cpu = case when qs.execution_count = 0 then 0 else qs.total_worker_time/qs.execution_count/1000 end, db_name = case convert(int, pa.value) when null then '--unknown--' when 0 then '--unknown--' when 32767 then 'Resource' else db_name(convert(int, pa.value)) end, [db_id] = coalesce(convert(int, pa.value),0), hash_char = '' from sys.db_stats (nolock) as qs cross apply sys.dm_exec_plan_attributes(qs.plan_handle)as pa where pa.attribute = N'dbid' and isnull(convert(int,pa.value),0) = 8 order by qs.total_elapsed_time desc", cnt="1", total_reads="1888", total_writes="29", avg_writes="29",db_name="db1" I couldn't able to extract the statement_text column completely and the remaining columns are working fine index="index" source="source1"| rex field=_raw "statement_text\=\"(?<statement_text>[@ ( ) $ . , \"A-Z ! ^ | \" - _ : { } A-Z a-z _ 0-9]+]+)\"" | rex field=_raw "cnt\=\"(?<cnt>[0-9]+)\"" | rex field=_raw "diff_reads\=\"(?<diff_reads>[0-9]+)\""| rex field=_raw "total_writes\=\"(?<total_writes>[0-9]+)\"" | rex field=_raw "db_name\=\"(?<db_name>[A-Z a-z _ 0-9]+)\"" Please provide me rex for statement_text column where the data can be extracted till the 2nd column "cnt"
... View more
Labels
- Labels:
-
other
10-04-2021
10:32 AM
Hi Team, Could someone help me with the field extraction for the below complex data(1000 lines of data I concised to 10 lines of data ) : columns to be extracted are statement_text , cnt, total_reads, total_writes, db_name statement_text="SELECT ISNULL("Interface Entry Header"."timestamp",@3) AS "timestamp",ISNULL("Interface Entry Header"."ImageURL",@8) AS "ImageURL",ISNULL("Interface Entry Header"."Pick Date Time",@7) AS "Pick Date Time",ISNULL("Interface Entry Header"."Start Execution",@7) AS "Start Execution",ISNULL("Interface Entry Header"."End Execution",@7) AS "End Execution",ISNULL("Interface Entry Header"."Send Request",@7) AS "Send Request",ISNULL("Maximo Issue Type$Interface Entry Line"."Header Entry No_",@4) AS "Maximo Issue Type$Interface Entry Line$Header Entry No_",ISNULL("Maximo Issue Type$Interface Entry Line"."Entry No_",@4) AS "Maximo Issue Type$Interface Entry Line$Entry No_" FROM "Algeria".dbo."Tango$Interface Entry Line" AS "Maximo Issue Type$Interface Entry Line" WITH(READUNCOMMITTED) WHERE ("Maximo Issue Type$Interface Entry Line"."Header Entry No_"="Interface Entry Header"."Entry No_") ORDER BY "Maximo Issue Type$Interface Entry Line$Header Entry No_" ASC,"Maximo Issue Type$Interface Entry Line$Entry No_" ASC) AS "SUB$Maximo Issue Type" WHERE ("Interface Entry Header"."Interface Code"=@0 AND "Interface Entry Header"."Direction"=@1 AND "Interface Entry Header"."Status"=@2) ORDER BY "Source No_" ASC,"Entry No_" ASC OPTION(OPTIMIZE FOR UNKNOWN, FAST 50)", cnt="12", total_reads="31", total_writes="0", db_name="test" I couldn't able to extract the statement_text column completely and the remaining columns are working fine index="index" source="source1"| rex field=_raw "statement_text\=\"(?<statement_text>[@ ( ) $ . , \"A-Z ! ^ | \" - _ : { } A-Z a-z _ 0-9]+]+)\"" | rex field=_raw "cnt\=\"(?<cnt>[0-9]+)\"" | rex field=_raw "diff_reads\=\"(?<diff_reads>[0-9]+)\""| rex field=_raw "total_writes\=\"(?<total_writes>[0-9]+)\"" | rex field=_raw "db_name\=\"(?<db_name>[A-Z a-z _ 0-9]+)\"" Please provide me rex for statement_text column where the data can be extracted till the 2nd column "cnt"
... View more
Labels
- Labels:
-
other
-
saved search
-
summary indexing
02-02-2021
09:33 AM
@adonio @niketn could you provide a stanza for [perfmon://Process] to receive process_mem_used
... View more
02-02-2021
09:24 AM
@richgallowaywe observed that process_mem_used data is not being sent to splunk. Could you please provide Stanza to add in input.conf
... View more
01-25-2021
11:08 AM
@richgalloway - Thank you for responding Below is the screenshot of my results and high_mem_per_proc is not giving exact results
... View more
01-24-2021
09:23 AM
Hi, Could someone please help me with the Alert for High Memory Usage Per Process Whenever the memory used per process is higher that 90% then trigger an alert. Below is the query which I tried but not working. index="index" sourcetype="PerfmonMk:Process" process_name="sqlservr" | eval Proc_Mem_mb = process_mem_used / (1024 * 1024) | fields Proc_Mem_mb process_name host _time | join host [ search index="index2" sourcetype="WinHostMon" Type=OperatingSystem | eval Tot_Mem_mb = TotalPhysicalMemoryKB/1024 | fields host Tot_Mem_mb ] | eval high_mem_per_proc = ( (Proc_Mem_mb/Tot_Mem_mb) * 100 ) | eval AlertStatus=if(high_mem_per_proc > 90, "Alert", "Ignore") |table _time host process_name Tot_Mem_mb Proc_Mem_mb high_mem_per_proc AlertStatus | search AlertStatus="Alert"
... View more
Labels
- Labels:
-
alert condition
-
other
11-24-2020
10:58 PM
It's working, Thank you very much for your prompt support @thambisetty
... View more
11-24-2020
09:45 PM
Hi, Could someone please help me with the rename of the string Values in the fields. I want to remove the spaces from the below-highlighted values here is the query I'm trying : index="index" sourcetype=_json |spath path="results{}.summary" output=Summary| spath path="results{}.description" output=Description |spath path="results{}.category" output=Category |spath path="results{}.sysAdmin" output=SysAdmin |rename Values(Summary) as values|rename values("User deactivated") AS "User_deactivated" | table Summary Category SysAdmin
... View more
Labels
- Labels:
-
field extraction
-
fields
11-23-2020
11:46 PM
index="index" sourcetype="Logs"|spath path="results{}.creationDate" output=CreationDate|eval time= CreationDate/1000|eval humanTime = strftime(CreatedDate/1000', "%c")|spath path="results{}.summary" output=Summary | spath path="results{}.description" output=Description | table humanTime ,Summary, Description
... View more
11-23-2020
11:42 PM
Hi, please find the below results: index="index" sourcetype="Logs"|spath path="results{}.creationDate" output=CreationDate|eval time= CreationDate/1000|convert ctime(time) as humanTime |spath path="results{}.summary" output=Summary | spath path="results{}.description" output=Description | table humanTime ,Summary, Description
... View more
11-23-2020
07:16 AM
Thank you for the response, But, It didn't help me, no output is shown. I think (1605030538646)its a combination of Date and time
... View more
11-23-2020
06:12 AM
Could someone please help me convert epoch time to human readable time? "Date":1605030538646
... View more
Labels
- Labels:
-
field extraction
-
other
11-23-2020
06:05 AM
Hi, I'm looking for the answer for the question you posted, Do you find any answer for this?
... View more
11-20-2020
03:58 AM
This regex is not working, Could you please help me with the Line_Breaker
... View more
11-15-2020
05:11 PM
In a single event, I have multiple rows, (having 7 colons (:) )for each row
... View more
11-15-2020
05:03 PM
Thank you for your response! The Query which I"m trying is: index="index" source="E:\\Logs\\log.csv"|rename values(Date) as * | search Date="*:*"| mvexpand Date| eval Name=mvindex(split(Date,":"),0), Version=mvindex(split(Date,":"),1), VendorName=mvindex(split(Date,":"),2) |fields Name Version VendorName | table Name Version VendorName The field names to extract are name, version, VendorName, usesLicensing, LicenseType, ExpiryDateString, LicenseKey, SEN But I'm to extract only one row from the below Event Event Data:(having multiple rows in single event) "name":"version":"VendorName":"usesLicensing":"LicenseType":"ExpiryDateString":"LicenseKey":"SEN" "Atlassian Troubleshooting and Support Tools":"1.24.1":"Atlassian":"False":::: "Confluence Cloud Migration Assistant":"2.5.1":"Atlassian":"False":::: "Copy Space Plugin":"2.3":"Atlassian":"False":::: "SAML Single Sign On for Confluence":"3.5.3":"re:solution":"True":"COMMERCIAL"::"AAABbQ0ODAoPeNqVkV9rwjAUxd/zKQJ70QdL63T+gcKkFiZTO1a3p73cdbc1mKblJpG5T7+0VuYeL YSQe5LfPef2bmeRLzHjwYT707k/mvszHqU7PvSDGdva8hMpyd80kg4D331siTojURtRqTBdbNY8F aqQ6LZC8UTxXpomfR5VKpcWVYY8r+j62EuRjkh93uJ4i/6YuxtliZQJkHwtMlQaWUQITZslGAwbP 4NgOAimzMEMZGYLJYZrewD9w/kzHCp5UeINCBnKVvIOjfK4R6HwgMrLqpLFR5C2RYc5SNfJFT1CX UnbFD0wEnQtbSGU9jSUUuvK+4vguRbiiKEhi0yezb67FA1veCsrNUAGqTPijCuDCpwSf9eCTl32o d9mn7CEClBCn80/daH4yj0i1RZBsjTehm4NgvH9eDIePbBuoFdEq6QohcGvi7Y71dgONEo2m/g1W i3WtybBxkRNQneTebGU7UHj/983Yb/LuNtnMCwCFHR9orCqkZtBlrvqerjNLSnZ71C4AhQQjh4x1 1O2SMKZihnj4mbQ2jX+bw==X02ht":"SEN-15357546" "SAMLWrapper-Plugin":"3.5.3":"re:solution":"False":::: "Team Calendars":"6.0.49":"Atlassian Pty Ltd":"True":"COMMERCIAL"::"AAABTg0ODAoPeNpdkF9LwzAUxd/zKQK+6MNGWwZdBwGlKzjcH3HVJ0Gu2a0LTdNykwz105t2FXSBv Nyc/O4556r0yJcoeZzyaL6IZoso4/m+5EkUZ2yJVpLqnGqNKBEanoNGcwCyvGqJ562ptEcjkV/vk U5INzyOwuHPFsm+LoKiaZCkAs3XSqKxyLa+eUfaVYNEDHLmAvtN/rKnaBxSR8qicOSR5YTQe1iCQ 9Ebm8TJJJ6zsN+BdFtoUKx9Dfab8weoW30JDCJ1GmEXT3sHFLaJCnQwNxKLDSgt9ICc1j3x9ojKY I1mKtuGFSfQfrA0/tPncC8hUj9MWACEEAZCN8Vnp+hr9J5Eg/f00sbYTvnV4RAn3202xVO+uluzH X2AUfa87n60wVd9R2YYgmb7YivCnczTLEtmMzbi/qz2RqtGOTywR0/yCBb/t5myH9wCtHUwLgIVA I9H5o1K8FkD5GzwxpwvJeR1NEfQAhUAkR4yfmoZx9KvHtEXWsZQ8+8qaAM=X02gk":"SEN-8799244" "techradar":"1.1":"it-economics GmbH":"False"::::
... View more
- Tags:
- @niketnilay
11-13-2020
08:09 AM
Hi, I want to extract the fields Name, Version, VendorName, usesLicensing, LicenseType, ExpiractDateString, LicenseKey, SEN based on delimiter(:) from the below raw data Could someone please help me with the query for field extraction.
... View more
Labels
- Labels:
-
eval
-
field extraction
-
fields
-
rex
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-15-2022
02:22 PM
|
Karma given to
