Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About iqbalintouch
iqbalintouch
Path Finder
Member since:
02-01-2016
02-08-2023
Community Statistics
| Posts | 53 |
| Solutions | 0 |
| Karma Given | 13 |
| Karma Received | 4 |
| Member Since | 02-01-2016 |
Activity Feed
- Posted Re: Eliminate the refund failure transactions using backup processor on Splunk Search. 10-01-2021 06:38 PM
- Posted Re: Eliminate the refund failure transactions using backup processor on Splunk Search. 09-19-2021 06:49 AM
- Posted Re: Eliminate the refund failure transactions using backup processor on Splunk Search. 09-18-2021 06:24 PM
- Posted Eliminate the refund failure transactions using backup processor on Splunk Search. 09-17-2021 09:05 PM
- Tagged Eliminate the refund failure transactions using backup processor on Splunk Search. 09-17-2021 09:05 PM
- Tagged Eliminate the refund failure transactions using backup processor on Splunk Search. 09-17-2021 09:05 PM
- Posted Re: How to Extract specific word from application log on Splunk Search. 01-17-2021 09:54 AM
- Karma Re: How to Extract specific word from application log for scelikok. 01-17-2021 09:53 AM
- Posted How to Extract specific word from application log on Splunk Search. 01-11-2021 11:42 PM
- Got Karma for how to get the count of different ErrorID's from application log. 10-11-2020 11:02 AM
- Posted Re: how to get the count of different ErrorID's from application log on Splunk Search. 10-11-2020 10:50 AM
- Posted how to get the count of different ErrorID's from application log on Splunk Search. 10-10-2020 08:29 PM
- Tagged how to get the count of different ErrorID's from application log on Splunk Search. 10-10-2020 08:29 PM
- Tagged how to get the count of different ErrorID's from application log on Splunk Search. 10-10-2020 08:29 PM
- Karma Re: How to apply a regular expression that pulls multiple values from application log and show them for Yorokobi. 08-04-2020 10:35 PM
- Posted Re: How to check log volume indexed per day in a particular index on Reporting. 08-04-2020 09:11 PM
- Karma Re: How to check log volume indexed per day in a particular index for to4kawa. 08-04-2020 09:11 PM
- Karma Re: How to list my Splunk users and their email addresses? for bandit. 08-04-2020 09:08 PM
- Posted Re: How to check log volume indexed per day in a particular index on Reporting. 07-15-2020 03:28 PM
- Tagged Re: How to check log volume indexed per day in a particular index on Reporting. 07-15-2020 01:11 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-01-2021
06:38 PM
@somesoni2 @woodcock could you please help.
... View more
09-19-2021
06:49 AM
index, sourcetype and are same..netconnect(non-INR trxn) and sourcejet(INR trxn) are payment processor for the application. sourcejet is the primary payment processor for INR based trxn and if the refund fails system makes a retry using the backup processor netconnect(non-INR trxn). for example below messages will be printed in the log if refund process failed through sourcejet and system is making the retry attempt using netconnect. <myapp.com.sys.BillingStrategy.performCredit(?:?):[***ROS CREDIT] attempting credit using the backup network adapter, adapter=SourcejetPaymentRoutingNetworkAdapter for ID=91113274385 and invoice=656578904> in the above log id ID is bookingId in the refund log. thank you.
... View more
09-18-2021
06:24 PM
Hi @ITWhisperer , so, I need only those bookingId which are available here: Netconnect log: <myapp.com.sys.BillingLogger.logResponse(?:?):stage=final; type=payment; service=PaymentCollect; processor=sourcejet; method=refund; itemType=F; status=failed; latency=602; payMode=Card; CardType=visa; bookingId=91113274385; error='Decline - Generic Error. No other information provided'> and NOT here: Sourcejet log: <myapp.com.sys.BillingLogger.logResponse(?:?):stage=final; type=payment; service=PaymentCollect; processor=sourcejet; method=refund; itemType=F; status=failed; latency=602; payMode=Card; CardType=visa; bookingId=91113274385; error='Decline - Generic Error. No other information provided'> what it means is, the sourcejet processor is the primary processor for refund process and in case of any system error or network glitch; the app makes a retry using the backup processor(netconnnect). Also, there are certain refund requests which gets processed through netconnect only and for such transactions/refunds there will be only one entry. so, is there any way to fetch the bookingId's which are available in netconnect log only. both the logs are identical except the except the processor field value, it would be either 'netconnect' or 'sourcejet' let me know if you need more details. thank you!
... View more
09-17-2021
09:05 PM
Hi In my app there are 2 payment processor, netconnect(backup) and sourcejet(primary), where is netconnect is the backup processor. I have created a report query which pulls the refund data from the logs given below log: <myapp.com.sys.BillingLogger.logResponse(?:?):stage=final; type=payment; service=PaymentCollect; processor=netconnect; method=refund; itemType=F; status=failed; latency=602; payMode=Card; CardType=visa; bookingId=91113274385; error='Decline - Generic Error. No other information provided'> The query used is as below: stage=final type=payment processor=netconnect method=refund status=failed bookingId=* paymentMode=* | stats count by bookingId Output: bookingId Count 91113274385 1 91111234567 1 91114567890 1 Now the issue here is in certain scenario system makes a retry using the backup net connect processor. This happens when the first call for refund to sourcejet failed due to a system error. Netconnect log: <myapp.com.sys.BillingLogger.logResponse(?:?):stage=final; type=payment; service=PaymentCollect; processor=sourcejet; method=refund; itemType=F; status=failed; latency=602; payMode=Card; CardType=visa; bookingId=91113274385; error='Decline - Generic Error. No other information provided'> Sourcejet log: <myapp.com.sys.BillingLogger.logResponse(?:?):stage=final; type=payment; service=PaymentCollect; processor=sourcejet; method=refund; itemType=F; status=failed; latency=602; payMode=Card; CardType=visa; bookingId=91113274385; error='Decline - Generic Error. No other information provided'> If there is a way to eliminate the sourcejet failures using net connect for backup
... View more
01-17-2021
09:54 AM
Hi @scelikok , thank you, I was looking for this thing exactly. Sorry for the late reply 🙂
... View more
01-11-2021
11:42 PM
Here is the sample log and I need to check which modelId is having most of the error using rex and stats count ####<Jan 11, 2021 11:17:52.338 PM PST> <ERROR> <myapp.main.catalog.store.trxn.OrderResponseValidator> <bus-ser15> <bus-ser1515_5> <requestId=9c4q00cv-e10x-00b4-z55f-11b44dc4c37m> <clientIp=11.22.33.222> <myapp.main.catalog.store.trxn.OrderResponseValidator.logOrderResponseValidationError(?:?):Productadd service error for modelId 765431 and reference number null[Model is not available in the store], [An error has occurred. Please verify your order status.]> Can someone please help?
... View more
Labels
- Labels:
-
field extraction
-
rex
-
stats
10-11-2020
10:50 AM
@ITWhisperer hi, this worked, thank you. Can I use this anywhere, if error log are similar?
... View more
10-10-2020
08:29 PM
1 Karma
Hello splunk users, Can someone help me with a solution? I am running my base search query to see the error in response, but the error id coming in the response is not showing as a field so I am not able to generate a timechard for all the different errors/error id's. I need your help on this, since I am very weak in using rex command I can't think a solution at my own: Base search query:- ("Unexpected partner error.." OR "Timeout occurred waiting for response from Fulfillment - java.net.SocketTimeoutException: Read timed out") GenerateBookingResponse ERROR source="/var/log/myapp/electronic-purchase-service/electronic-purchase-service.log" Below is the sample of error response. Every error is having a unique errorid associated with it: 2019-01-10 19:39:21.454 [https-jsse-nio-8080-exec-10] [hdhdhda704-4444-44a1-bbbb-52857lllcd1d] INFO EndpointLogger - endpoint=my-endpoint; operation=createOrder; duration=4517, response=<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><ns3:GenerateBookingResponse xmlns:ns1="urn:myworld:dom:common:defn:v1" xmlns:ns10="urn:myworld:dm:hhhhh:hhhhh:define:v1" xmlns:ns11="urn:myworld:dom:supply:messages:defn:v1" xmlns:ns12="urn:myworld:dom:vvvv:datatype:define:v1" xmlns:ns13="urn:myworld:c3:data:placetypes:defn:v4" xmlns:ns14="urn:myworld:c3:data:messagetypes:defn:v5" xmlns:ns2="urn:myworld:ddom:datatype:define:v1" xmlns:ns3="urn:myworld:dom:order:messages:v1" xmlns:ns4="urn:myworld:ord:order:persisttypes:v2" xmlns:ns5="urn:myworld:c3:data:financetypes:define:v5" xmlns:ns6="urn:myworld:c3:data:financetypes:defn:v4" xmlns:ns7="urn:myworld:c3:data:basetypes:defn:v4" xmlns:ns8="urn:myworld:c3:data:timetypes:define:v4"><ns1:MessageInfo CreateDateTime="2019-01-10T19:39:16.935-07:00" MessageGUID=“0102037-048a-49a9-08u5-2222ba059e2a" TransactionGUID=“11111111-ac11-1a11-22d7-eb1a2c333333><ns1:DebugTraceBoolean>false</ns1:DebugTraceBoolean></ns1:MessageInfo><ns1:MessageStatus><ns1:Status>Failure</ns1:Status><ns1:ErrorList><ns1:Error><ns1:MessageTransactionInfo><ns1:Category>ExternalError</ns1:Category><ns1:Code>0000</ns1:Code><ns1:Description>Unexpected partner error..</ns1:Description><ns1:Namespace>urn:myworld:c3:ss:electronic:digitalinterface:purchasecommontypes:define:v2</ns1:Namespace><ns1:ExternalErrorList><ns1:ExternalError><ns1:ExternalErrorID>10007</ns1:ExternalErrorID><ns1:ExternalErrorDescription>Unexpected partner error..</ns1:ExternalErrorDescription></ns1:ExternalError></ns1:ExternalErrorList></ns1:MessageTransactionInfo></ns1:Error></ns1:ErrorList></ns1:MessageStatus><ns1:MobileOrderProcessRelationNO>ab7cdc43-f8a6-4cdf-0000-33t4f530u65a</ns1:MobileOrderProcessRelationNO></ns3:GenerateBookingResponse></soap:Body></soap:Envelope> I need to generate a timechart based on the error or error ID. thanks a lot in advance.
... View more
Labels
- Labels:
-
field extraction
08-04-2020
09:11 PM
@to4kawa thank you, this is great help. sorry for the late response, also could you please explain the query..how it is calculating 🙂
... View more
07-15-2020
03:28 PM
Unfortunately, that I don't know how much data is being sent in a single event since we are seeing these events in REQUEST/RESPONSE which we send/receive from a third party. 😞 @to4kawa
... View more
07-15-2020
01:10 PM
@to4kawa thank you for the response. I am getting the result but not sure if that is showing log size..if yes, is there way to convert in GB size?
... View more
- Tags:
- report
07-11-2020
11:23 PM
Is there anyway to check how much log is being generated with DEBUG log mode for a particular index? Let say if index name is my_index and I need to check what is size of log generated for DEBUG mode log index=my_index DEBUG @woodcock plz help 🙂
... View more
Labels
- Labels:
-
summary indexing
06-04-2020
03:29 PM
Hi all,
I've been struggling to extract certain values from application logs and assign them to the given field name. As I don't know how to use or write regular expression in splunk, I need help to write a query to get the desired output. Here is my base search query:
https://www.myapplication.com/myapi/version5/autofill/ "ERROR"
here is the output log:
"ERROR" "store.view.app.api.controller.myClientLoggingController" "viewhost02" "myview2_2" <> "catalina-exec-7" "requestId=d4s6666-9d6e-2c0g-7c20-6e9f7wfa7f6" <> "clientIp=234.234.234.22" "store.view.app.api.controller.myClientLoggingController.logError(?:?):My-AngularApp
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxcxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
NOTE: in above log I have replaced the brackets <> with quotes ""
Now I want to extract the "requestId", "clientIp" and "My-AngularApp" and assign them to field name as "Req_ID", "Cust_IP" and "App_Name" respectively.
Can someone please help with the query to achieve the desired output, as I always struggle with REX syntax and can't write the query by my own.
Thank you in advance.
... View more
05-12-2020
02:33 PM
thank you @richgalloway , so that means the trigger condition in the screenshot not need to change..only base query require changes ?
please correct me.
... View more
05-12-2020
12:32 PM
@woodcock hi,
if you can help, please.
thanks in advance.
... View more
05-12-2020
12:24 PM
Hi,
I want to create an alert which gets triggered if the failure count is more than 5 in last 5 minutes:
1- it should run on every 5 minutes 2- it should send an email as well
Here is base search and settings as well:
index=myindex sourcetype=xyz host=“tus3crs” "EventLogger*" AND "Purchase event" vertical=Stationary Type=Notebook (PurchaseStatus=510 OR PurchaseStatus=515 OR PurchaseStatus=530 OR PurchaseStatus=540) | dedup itemId sortBy -_time
NOTE- These status are different failure states of the item
Please help me with setting up this alert. thank you.
... View more
Labels
- Labels:
-
alert condition
-
email
04-16-2020
02:10 PM
Hi,
How can I pull a list or report of alerts which is having any of these specific words? "purchase" OR "search" OR "booking"
... View more
Labels
- Labels:
-
alert condition
03-04-2020
10:17 PM
Hi,
is there anyway to pull a report to get the data of log where DEBUG level log is enabled, based on the index and sourcetype?
I am using below query to get the data:
index=myapp sourcetype=ejb_app_logs DEBUG | eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by s useother=false
... View more
01-30-2020
09:31 PM
This is the text which is being print in our app logs :
throws abc.xyz.error.AppException,java.rmi.RemoteException, with 1 error(s): [Error in object 'MyAccountRQ': codes [Password must not contain spaces and must have 6-30 characters.MyAccountRQ,Password must not contain spaces and must have 6-30 characters];
the text in the [text] bracket could be different errors, I need to print it as" codes [] " in format.
Can anyone please help I tried with simple search query with but that doesn't serves the purpose.
Please help, I am a learner of splunk.
... View more
10-21-2019
10:26 PM
if I need to pull the data where userBilledAmount !=0.0 ??
how to achieve..your query has given near to desired output..
... View more
10-21-2019
09:31 PM
sourcetype=abc "responseStatus=500" "abc.xyz.logging.yyyy.zzzzz" "cccccccccccccc88888883333hhhh" | rex field=_raw "\"customerBilledAmount\" : (?.?)," | rex field=_raw "\"resultID\" : (?.?)," | rex field=_raw "\"customerID\" : (?.*?)," | dedup resultID | table userrBilledAmount resultID customerID
Now I need to achieve
- exclude all null
- add up all userBilledAmount
- exclude all null from userBilledAmount only
... View more
05-27-2019
11:19 PM
Hi DavidHourani,
Thank you for the response but this doesn't helped.
We don't have this index and sourcetype. What I am looking for a report from Microsoft outlook using their API and by running query in splunk.
Regards,
Iqbal
... View more
05-24-2019
08:22 PM
Hi,
I want to pull a report which reads a specific subject line from outlook emails and tells me that how many times I have received the same email and on which dates particularly.
i.e: if the email subject line says, "My Alert: ecom sale low volume Alert" , I need to pull a report for this alert and when this alert was received in last 1 year and how many times.
so the report should contain 3 columns, subject_line - received date - frequency/counts of this email
... View more
05-29-2018
04:14 PM
Thank you @niketnilay it was great help 🙂
... View more
05-29-2018
12:50 AM
thank you @niketn, final query will be like this (below)??
index=myindex sourcetype=xyz host="tus*" "EventLogger*" "Search event" "pcrState=N"
| stats max(_time) as _time count by host
| eval dataSource="events"
| append
[
| makemv host delim=","
| mvexpand host
| eval count=0, _time=now()]
| stats max(_time) as triggerTime sum(count) as eventCount values(cluster) as cluster values(dataSource) as dataSource by host
| search eventCount=0
| sort cluster host
| fieldformat triggerTime=strftime(triggerTime,"%Y/%m/%d %H:%M:%S %p")
| table cluster host triggerTime eventCount
... View more
