- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Split log entries from fixed number of characters
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I want to find results after timestamp in below results i.e. to separate "[2012-09-28 08:46:22,410]" & the message in each entry.
[2012-09-28 08:46:22,410] [ERROR] Device 6642(matt) encountered error. Error: ClientError: Bad Request
[2012-09-28 08:46:38,277] [WARNING] Client PPC-6DFF06C758C(7162, 7013, reported: Backup failed. Error: Quota limit reached. (#10000000e)
Please help...
Thanks and Regards,
Amit
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So, to be able to filter your search results based on the log message excluding the initial timestamp, first of all extract that text to a field. This can be done with the rex command:
... | rex "^.+?\]\s+(?<logmessage>.+)"
Then simply run dedup on this field, which will cause Splunk to drop all events that have duplicate values of an event it has already seen:
... | rex "^.+?\]\s+(?<logmessage>.+)" | dedup logmessage
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So, to be able to filter your search results based on the log message excluding the initial timestamp, first of all extract that text to a field. This can be done with the rex command:
... | rex "^.+?\]\s+(?<logmessage>.+)"
Then simply run dedup on this field, which will cause Splunk to drop all events that have duplicate values of an event it has already seen:
... | rex "^.+?\]\s+(?<logmessage>.+)" | dedup logmessage
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
My bad, I seem to have dropped a ? sign at the beginning of the matching group. It should (?<logmessage>...), not (<logmessage>...). Editing my answer to correct that.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks Ayn..
but it is giving below error::
Error in 'rex' command: The regex '^.+?]\s+(
I want to apply this criteria in search field itself when i m searching for specific logs and then remove timestamp there.Then i can download a csv and even select unique fields there also or if possible in Splunk,plz tell..
Regards,
Amit
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you give the syntax applicable in this case...all these entries are coming in single field in my case.
Thanx,
Amit
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Remove how? dedup? You could just extract the text after the timestamp as a field, or just some other specific part of the event text, and then dedup that to get rid of duplicates in your search results...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes Ayn,I will then remove unique repeated events from all events happened in 24 hours.
Can you help?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I don't understand - do you want the text after the timestamp to be in a separate, timestamp-less event? Why? What's the use-case?
Introducing Splunk Enterprise 9.2
Adoption of RUM and APM at Splunk
Routing logs with Splunk OTel Collector for Kubernetes
