- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to display the time of one search in the final...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Below is my search.
What I need is to have the time related to that error also saved(Timen) and then shown in the final result which has result of another subsearch.
When I run it, I am getting the value of only FIELDNAME1 and not Timen.
index!=_internal "error" " |eval Timen=strftime(_time,"%m/%d/%y %T")| accum Timen| rex "(?i)text>(?P[^<]+)" | dedup FIELDNAME | map search="search index!=_internal $FIELDNAME$" | search "error1 " |rex "(?i)text1=(?P[^]]+)" | rex "(?i)text2=(?P[^]]+)" | eval Time=strftime(_time,"%m/%d/%y %T")| table FIELDNAME1 Time Timen
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Give this a try
index!=_internal "error" |eval Timen=strftime(_time,"%m/%d/%y %T")| rex "(?i)text\>(?P<FIELDNAME>[^\<]+)" | dedup FIELDNAME | table Timen FIELDNAME | map search="search index!=_internal $FIELDNAME$ | eval Timen=\"$Timen$\"" | search "error1 " |rex "(?i)text1=(?P<FIELDNAME1>[^\]]+)" | eval Time=strftime(_time,"%m/%d/%y %T")| table FIELDNAME1 Time Timen
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Give this a try
index!=_internal "error" |eval Timen=strftime(_time,"%m/%d/%y %T")| rex "(?i)text\>(?P<FIELDNAME>[^\<]+)" | dedup FIELDNAME | table Timen FIELDNAME | map search="search index!=_internal $FIELDNAME$ | eval Timen=\"$Timen$\"" | search "error1 " |rex "(?i)text1=(?P<FIELDNAME1>[^\]]+)" | eval Time=strftime(_time,"%m/%d/%y %T")| table FIELDNAME1 Time Timen
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
One more question. What if i have to display the FIELDNAME along with Timen?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It doesnt work. It displays $Timen and not the value
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Oops, missed a $ sign there. Try now.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Perfect. It works. Thanks a lot for your kind help on this!!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Okay i found that this doesnt actually provide the result i am expecting. Let me correct my quetion. I need to know the time of the exact FIELDNAME which matches with the error1 field. (There can be multiple results for that fieldname initially and the timen is showing the latest one for that)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The field names are stripped off in the question, making is difficult to understand. Apart from correcting that, could you also, describe your requirement here in little more details?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
index!=_internal "error" " |eval Timen=strftime(_time,"%m/%d/%y %T")| rex "(?i)text>(?P[^<]+)" | dedup FIELDNAME | map search="search index!=_internal $FIELDNAME$" | search "error1 " |rex "(?i)text1=(?P[^]]+)" | eval Time=strftime(_time,"%m/%d/%y %T")| table FIELDNAME1 Time Timen
I want to display the field Timen in my results. Currently it displays only FIELDNAME1 and Time and not Timen
Introducing Splunk Enterprise 9.2
Adoption of RUM and APM at Splunk
Routing logs with Splunk OTel Collector for Kubernetes
