Hi All,   I have logs like below in splunk: Log1: Tue Feb 25 04:00:20 2024 EST 10G 59M 1% /apps Log2: Tue Feb 25 04:00:20 2024 EST 10G 6.4G 64% /logs Log3: Tue Feb 25 04:00:20 2024 EST 10G 2G 20% /opt Log4: Tue Feb 25 04:00:20 2024 EST 30G 282M 1% /var  I have used the below query to extract the required fields: ... | rex field=_raw "EST\s(?P<Total_Space>[^\s]+)\s(?P<Used_Space>[^\s]+)\s(?P<Disk_Usage>[^%]+)\%\s(?P<File_System>[^\s]+)" Here, the output values of "Used_Space" field has both GB and MB values and I need to convert only MB values to GB.  Please help to create a query to get the MB values only converted to GB.   Your kind inputs are highly appreciated..!! Thank You..!! ... View more

Hi All, I got a logs like below and I need to create a table out of it.   <p align='center'><font size='4' color=blue>Disk Utilization for gcgnamslap in Asia Testing -10.100.158.51 </font></p> <table align=center border=2> <tr style=background-color:#2711F0 ><th>Filesystem</th><th>Type</th><th>Blocks</th><th>Used %</th><th>Available %</th><th>Usage %</th><th>Mounted on</th></tr> <tr><td> /dev/root </td><td> ext3 </td><td> 5782664 </td><td> 1807636 </td><td> 3674620 </td><td bgcolor=red> 33% </td><td> / </td></tr> <tr><td> devtmpfs </td><td> devtmpfs </td><td> 15872628 </td><td> 0 </td><td> 15872628 </td><td bgcolor=white> 0% </td><td> /dev </td></tr> <tr><td> tmpfs </td><td> tmpfs </td><td> 15878640 </td><td> 10580284 </td><td> 5298356 </td><td bgcolor=red> 67% </td><td> /dev/shm </td></tr> <tr><td> tmpfs </td><td> tmpfs </td><td> 15878640 </td><td> 26984 </td><td> 15851656 </td><td bgcolor=white> 1% </td><td> /run </td></tr> <tr><td> tmpfs </td><td> tmpfs </td><td> 15878640 </td><td> 0 </td><td> 15878640 </td><td bgcolor=white> 0% </td><td> /sys/fs/cgroup </td></tr> <tr><td> /dev/md1 </td><td> ext3 </td><td> 96922 </td><td> 36667 </td><td> 55039 </td><td bgcolor=red> 40% </td><td> /boot </td></tr> <tr><td> /dev/md6 </td><td> ext3 </td><td> 62980468 </td><td> 28501072 </td><td> 31278452 </td><td bgcolor=red> 48% </td><td> /usr/sw </td></tr> <tr><td> /dev/mapper/cp1 </td><td> ext4 </td><td> 1126568640 </td><td> 269553048 </td><td> 800534468 </td><td bgcolor=white> 26% </td><td> /usr/p1 </td></tr> <tr><td> /dev/mapper/cp2 </td><td> ext4 </td><td> 1126568640 </td><td> 85476940 </td><td> 984610576 </td><td bgcolor=white> 8% </td><td> /usr/p2 </td></tr> </table></body></html>   I used below query to get the table:   ... | rex field=_raw "Disk\sUtilization\sfor\s(?P<Server>[^\s]+)\sin\s(?P<Region>[^\s]+)\s(?P<Environment>[^\s]+)\s\-(?P<Server_IP>[^\s]+)\s\<" | rex field=_raw max_match=0 "\<tr\>\<td\>\s(?P<Filesystem>[^\s]+)\s\<\/td\>\<td\>\s(?P<Type>[^\s]+)\s\<\/td\>\<td\>\s(?P<Blocks>[^\s]+)\s\<\/td\>\<td\>\s(?P<Used>[^\s]+)\s\<\/td\>\<td\>\s(?P<Available>[^\s]+)\s\<\/td\>\<td\sbgcolor\=\w+\>\s(?P<Usage>[^\%]+)\%\s\<\/td\>\<td\>\s(?P<Mounted_On>[^\s]+)\s\<\/td\>\<\/tr\>" | table Server,Region,Environment,Server_IP,Filesystem,Type,Blocks,Used,Available,Usage,Mounted_On | dedup Server,Region,Environment,Server_IP   And below is the table  I am getting: Server Region Environment Server_IP Filesystem Type Blocks Used Available Usage Mounted_On gcgnamslap Asia Testing 10.100.158.51 /dev/root devtmpfs tmpfs tmpfs tmpfs /dev/md1 /dev/md6 /dev/mapper/p1 /dev/mapper/p2 ext3 devtmpfs tmpfs tmpfs tmpfs ext3 ext3 ext4 ext4 5782664 15872628 15878640 15878640 15878640 96922 62980468 1126568640 1126568640 1807636 0 10580284 26984 0 36667 28501072 269553048 85476940 3674620 15872628 5298356 15851656 15878640 55039 31278452 800534468 984610576 33 0 67 1 0 40 48 26 8 / /dev /dev/shm /run /sys/fs/cgroup /boot /usr/sw /usr/p1 /usr/p2 Here, the fields Filesystem,Type,Blocks,Used,Available,Usage_Percent and Mounted_On are coming up in one row. I want the table to be separated according to the rows like below: Server Region Environment Server_IP Filesystem Type Blocks Used Available Usage Mounted_On gcgnamslap Asia Testing 10.100.158.51 /dev/root ext3 5782664 1807636 3674620 33 / gcgnamslap Asia Testing 10.100.158.51 devtmpfs devtmpfs 15872628 0 15872628 0 /dev gcgnamslap Asia Testing 10.100.158.51 tmpfs tmpfs 15878640 10580284 5298356 67 /dev/shm gcgnamslap Asia Testing 10.100.158.51 tmpfs tmpfs 15878640 26984 15851656 1 /run gcgnamslap Asia Testing 10.100.158.51 tmpfs tmpfs 15878640 1807636 15878640 0 /sys/fs/cgroup gcgnamslap Asia Testing 10.100.158.51 /dev/md1 ext3 96922 36667 55039 40 /boot gcgnamslap Asia Testing 10.100.158.51 /dev/md6 ext3 62980468 28501072 31278452 48 /usr/sw gcgnamslap Asia Testing 10.100.158.51 /dev/mapper/p1 ext4 1126568640 269553048 800534468 26 /usr/p1 gcgnamslap Asia Testing 10.100.158.51 /dev/mapper/p2 ext4 1126568640 85476940 984610576 8  /usr/p2 Please help to create a query to get the table in the above expected manner. Your kind inputs are highly appreciated..!! Thank You..!! ... View more

Hi All, I have got two queries to populate the host, region, tech stack & environment details. One query is a lookup table that has the list of total number of host.    | inputlookup Master_List.csv | search Region="Asia" | search "Tech Stack"="Apple" | rename host as Total_Servers | table Total_Servers   which gives below table: Total_Servers Apple1 Apple2 Apple3 Apple4 Apple5 Apple6 The second query gives us the list of hosts that are currently populating in splunk.   ... | rex field=_raw "(?ms)]\|(?P<host>\w+\-\w+)\|" | rex field=_raw "(?ms)]\|(?P<host>\w+)\|" | rex field=_raw "\]\,(?P<host>[^\,]+)\," | rex field=_raw "\]\|(?P<host>[^\|]+)\|" | regex _raw!="^\d+(\.\d+){0,2}\w" | regex _raw!="/apps/tibco/datastore" | lookup Master_List.csv "host" | search "Tech Stack"="Apple" | search Region="Asia" | rename host as "Reporting_Servers" | table "Reporting_Servers"   which gives below table: Reporting_Servers Apple1 Apple4 Apple5 Now I want to create a query to compare these two table and populate the servers that are missing from the total servers. So that output of the above tables after comparison should be like below: Non_Reporting_Servers Apple2 Apple3 Apple6   Please help me to create a query to achieve the expected output table. Your kind inputs are highly appreciated.   Thank You..!!! ... View more

Hi All, I have 2 similar queries as below to get the total host count and host count that are affected:   Query 1: To get total host count .... | rex field=_raw "(?ms)]\|(?P<host>\w+\-\w+)\|" | rex field=_raw "(?ms)]\|(?P<host>\w+)\|" | rex field=_raw "\]\,(?P<host>[^\,]+)\," | rex field=_raw "\]\|(?P<host>[^\|]+)\|" | rex field=_raw "(?ms)\|(?P<File_System>(\/\w+){1,5})\|" | rex field=_raw "(?ms)\|(?P<Disk_Usage>\d+)" | rex field=_raw "(?ms)\s(?<Disk_Usage>\d+)%" | rex field=_raw "(?ms)\%\s(?<File_System>\/\w+)" | regex _raw!="^\d+(\.\d+){0,2}\w" | regex _raw!="/apps/tibco/datastore" | rex field=_raw "(?P<Time>\w+\s\w+\s\d+\s\d+\:\d+\:\d+\s\w+\s\d+)\s\d" | rex field=_raw "\[(?P<Time>\w+\s\w+\s\d+\s\d+\:\d+\:\d+\s\w+\s\d+)\]" | rex field=_raw "(?ms)\d\s(?<Total>\d+(\.\d+){0,2})\w\s\d" | rex field=_raw "(?ms)G\s(?<Used>\d+(\.\d+){0,2})\w\s\d" | eval Available=(Total-Used) | eval Time_Stamp=strftime(_time, "%b %d, %Y %I:%M:%S %p") | lookup Master_List.csv "host" | search "Tech Stack"=* | search Region="GC" | search Environment=* | search host=* | search File_System=* | search Disk_Usage=* | stats count by host | stats count as Total Query 2: To get the affected host count .... | rex field=_raw "(?ms)]\|(?P<host>\w+\-\w+)\|" | rex field=_raw "(?ms)]\|(?P<host>\w+)\|" | rex field=_raw "\]\,(?P<host>[^\,]+)\," | rex field=_raw "\]\|(?P<host>[^\|]+)\|" | rex field=_raw "(?ms)\|(?P<File_System>(\/\w+){1,5})\|" | rex field=_raw "(?ms)\|(?P<Disk_Usage>\d+)" | rex field=_raw "(?ms)\s(?<Disk_Usage>\d+)%" | rex field=_raw "(?ms)\%\s(?<File_System>\/\w+)" | regex _raw!="^\d+(\.\d+){0,2}\w" | regex _raw!="/apps/tibco/datastore" | rex field=_raw "(?P<Time>\w+\s\w+\s\d+\s\d+\:\d+\:\d+\s\w+\s\d+)\s\d" | rex field=_raw "\[(?P<Time>\w+\s\w+\s\d+\s\d+\:\d+\:\d+\s\w+\s\d+)\]" | rex field=_raw "(?ms)\d\s(?<Total>\d+(\.\d+){0,2})\w\s\d" | rex field=_raw "(?ms)G\s(?<Used>\d+(\.\d+){0,2})\w\s\d" | eval Available=(Total-Used) | eval Time_Stamp=strftime(_time, "%b %d, %Y %I:%M:%S %p") | lookup Master_List.csv "host" | search "Tech Stack"=* | search Region="GC" | search Environment=* | search host=* | search File_System=* | search Disk_Usage>=80 | stats count by host | stats count as Total   I am able to get both the host count and create a dashboard panel in "single value" visualization in trellis layout separately. But I want to get both the host counts in one panel in trellis layout. (something like shown in the sample attachment) Please help to modify/create the query to get both host counts in one panel in the dashboard.   Your kind consideration is highly appreciated..!! Thank You..!!   ... View more

Hi All, I have got logs as below:   Log1: Tue Aug 1 12:15:03 EDT 2023 10G 6.4G 64% /var Log2: Tue Aug 1 12:15:03 EDT 2023 20G 5.9G 30% /opt Log3: Tue Aug 1 12:15:02 EDT 2023 11G 7.2G 66% /uam Log4: Tue Aug 1 12:15:02 EDT 2023 11G 7.2G 85% /mqr   Using below query, I created a pie chart for my dashboard:   **** | rex field=_raw "(?ms)]\|(?P<host>\w+\-\w+)\|" | rex field=_raw "(?ms)]\|(?P<host>\w+)\|" | rex field=_raw "\]\,(?P<host>[^\,]+)\," | rex field=_raw "\]\|(?P<host>[^\|]+)\|" | rex field=_raw "(?ms)\|(?P<File_System>(\/\w+){1,5})\|" | rex field=_raw "(?ms)\|(?P<Disk_Usage>\d+)" | rex field=_raw "(?ms)\s(?<Disk_Usage>\d+)%" | rex field=_raw "(?ms)\%\s(?<File_System>\/\w+)" | regex _raw!="^\d+(\.\d+){0,2}\w" | regex _raw!="/apps/tibco/datastore" | rex field=_raw "(?P<Time>\w+\s\w+\s\d+\s\d+\:\d+\:\d+\s\w+\s\d+)\s\d" | rex field=_raw "\[(?P<Time>\w+\s\w+\s\d+\s\d+\:\d+\:\d+\s\w+\s\d+)\]" | rex field=_raw "(?ms)\d\s(?<Total>\d+(\.\d+){0,2})\w\s\d" | rex field=_raw "(?ms)G\s(?<Used>\d+(\.\d+){0,2})\w\s\d" | eval Available=(Total-Used) | lookup Environment_List.csv "host" | search Environment="UAT" | eval UAT=if(Disk_Usage <= 79, "Below80%", "Above80%") | stats count by UAT   I have 3 other Environments (SIIT,DIT,DIT2), for which I created pie charts using above query and changing the environment name. Now, I have got 4 pie charts in 4 separate panels in the dashboard. I need to get all the 4 pie charts in one panel and want to create drilldown from that panel. (something like shown in the attachment) Please help to modify the query to get all the pie charts in one panel in the dashboard.    Your kind consideration is highly appreciated..!! Thank You..!!       ... View more

Hi All, I have got the below query at two different time range (Last 24 hrs and All Time). index=* | stats count by index,host  which gives a table as below: index host count abc hdcgcgmefla02uv 127976   Now I want to compare the host column in both the tables and populate it in a new column in a tabular view. If host is available in both time ranges, then the value is "Availabe" and if host is not available in any of the  time ranges the value will be "Not Available" Like below: index host Comparision abc hdcgcgmefla02uv Available abc hdcgcgmefla22uv Not Available xyz hdcgcgmefla12uv Available   Please help to create a query to get the table with the desired comparisons. Your kind inputs are highly appreciated. Thank you..!! ... View more