Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Splunk Answers
- :
- About Naji
Naji
Explorer
Member since:
07-19-2023
10-22-2023
Community Statistics
| Posts | 8 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 07-19-2023 |
Activity Feed
- Posted Re: Extract fields from JSON response on Splunk Search. 10-22-2023 08:30 PM
- Tagged Re: Extract fields from JSON response on Splunk Search. 10-22-2023 08:30 PM
- Posted Re: Extract fields from JSON response on Splunk Search. 10-17-2023 10:42 AM
- Tagged Re: Extract fields from JSON response on Splunk Search. 10-17-2023 10:42 AM
- Posted Extract fields from JSON response on Splunk Search. 10-17-2023 09:54 AM
- Posted Re: How to Split a field that is the subject of a Top command? on Splunk Search. 07-26-2023 09:36 AM
- Posted Re: How to Split a field that is the subject of a Top command on Splunk Search. 07-25-2023 07:38 AM
- Posted How to Split a field that is the subject of a Top command? on Splunk Search. 07-24-2023 02:54 PM
- Posted Re: Add a custom column based on host value on Splunk Search. 07-19-2023 07:44 AM
- Posted Add a custom column based on host value on Splunk Search. 07-19-2023 01:25 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
10-22-2023
08:30 PM
I tried what you suggested, but I was unable to get the results I expected. To resolve the issue, I had to disable Java log enrichment feature in Dynatrace OneAgent to stop OneAgent from injecting {dt.trace_id=837045e132ad49311fde0e1ac6a6c18b, dt.span_id=169aa205dab448fc, dt.trace_sampled=true} into my logs. Now things are back to normal.
... View more
- Tags:
- search
10-17-2023
10:42 AM
you are correct, some of the fields are automatically extracted as part of the Event heading, but none of the fields I am interested in are available, such as: tracePoint content.attributes[] //not interested in the headers applicationName applicationVersion environmen By the way, I tried what you suggested: | spath input=data but I see no change in my search results. Thank you
... View more
- Tags:
- search
10-17-2023
09:54 AM
I am new to Splunk and I have the following message which I would like to parse into a table of columns: {dt.trace_id=837045e132ad49311fde0e1ac6a6c18b, dt.span_id=169aa205dab448fc, dt.trace_sampled=true}
{
"correlationId": "3-f0d89f31-6c3c-11ee-8502-123c53e78683",
"message": "API Request",
"tracePoint": "START",
"priority": "INFO",
"category": "com.cfl.api.service",
"elapsed": 0,
"timestamp": "2023-10-16T15:59:09.051Z",
"content": {
"clientId": "",
"attributes": {
"headers": {
"accept-encoding": "gzip,deflate",
"content-type": "application/json",
"content-length": "92",
"host": "hr-fin.svr.com",
"connection": "Keep-Alive",
"user-agent": "Apache-HttpClient/4.5.5 (Java/16.0.2)"
},
"clientCertificate": null,
"method": "POST",
"scheme": "https",
"queryParams": {},
"requestUri": "/cfl-service-api/api/process",
"queryString": "",
"version": "HTTP/1.1",
"maskedRequestPath": "/api/queue/send",
"listenerPath": "/cfl-service-api/api/*",
"localAddress": "/localhost:8082",
"relativePath": "/cfl-service-api/api/process",
"uriParams": {},
"rawRequestUri": "/cfl-service-api/api/process",
"rawRequestPath": "/cfl-service-api/api/process",
"remoteAddress": "/123.123.123.123:123",
"requestPath": "/cfl-service-api/api/process"
}
},
"applicationName": "cfl-service-api",
"applicationVersion": "6132",
"environment": "dev",
"threadName": "[cfl-service-api].proxy.BLOCKING @78f55ba"
} Thank you so much for your help.
... View more
07-26-2023
09:36 AM
Thank you for your response. That query did not work for me at all. Here is what worked perfectly: index="myindex" sourcetype="hamlet" environment=staging
| rex field=client mode=sed "s/"@aol.com"|"@gmail.com"/""/g"
| eval percent = round(percent)
| rename client AS "Users", count AS "Requests", percent AS "Percentage %" In my case, I have one single domain to worry about.
... View more
07-24-2023
02:54 PM
When I ran the following query:
index="myindex" sourcetype="hamlet" environment=staging
| top limit=10 client
| eval percent = round(percent)
| rename client AS "Users", count AS "Requests", percent AS "Percentage %"
I get these results:
Users
Requests
Percentage %
joe.smith@alora.com
118
21
martha.taylor@gmail.com
80
14
paul.gatsby@aol.com
68
12
What I want instead are these results
Users
Requests
Percentage %
joe.smith
118
21
martha.taylor
80
14
paul.gatsby
68
12
I hope this helps. Sorry if my original post was confusing. I appreciate your help. Thank you
... View more
Labels
- Labels:
-
eval
07-19-2023
01:25 AM
Hi, let me first state that I am very new to Splunk. How can I do the following please? I would like to add a column called Department to my table. The department value is not part of the event data. It is something I would like to assign based on the value of host: Department Hosts IP Address Sales host1 15.20.10.5 host2 15.20.10.15 host3 15.20.10.25 HR host4 15.20.10.35 host5 15.20.10.45 host6 15.20.10.55 IT host7 15.20.10.65 host8 15.20.10.75 host9 15.20.10.85 I also would like to create a Department dropdown menu that filters hosts based on department (dashboard). Thank you for your time. I appreciate all your help
... View more
Labels
- Labels:
-
table
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-22-2023
11:51 PM
|
