About nmayafit

nmayafit · ‎03-22-2023

I tried his and yours with no luck. Lines with the specific attributes still show.

nmayafit · ‎03-22-2023

I don't need the original events, so I use stats, but it still shows as a line with this values

nmayafit · ‎03-22-2023

Thanks. I tried that already, but it still shows the results in the stats.

nmayafit · ‎03-21-2023

Hi. Subject is confusing so here goes. I have 3 log lines: org=A Status=Success org=A Status=Fail org=B Status=Success I would like to get stats for orgs that have Status=Success, but not if those orgs have even one log where Status=Fail. I tried to filter in the search query (but then, I get the line where org=A Status=Success) and in a WHERE clause, with no luck. I'm trying to find the right method to do this kind of filtering. Thanks!

nmayafit · ‎11-30-2017

Hi all, I found some partial data regarding what I need but the solution is still not found and I call for help. I'm sending SMS messages to customers in different countries and logging the undelivered and total amount count. What I want to do is alert when the undelivered number is passing the boundary (which I need to calculate). Find the anomaly. What I've done so far is calculate the percent of the undelivered from the total, averaged and created a standard deviation from the percent and created a boundary from (avg+stdev*2). But, this one will be good for a normal deviation. The problem is that SMS is not the same all the time and the total decrease on nights and weekends and increase on week days, so I need to insert some variable into my calculation that will take that into account and make the boundary increase when the total is low (I don't want the alert to trigger when 5 out of 10 messages were not delivered, 50%) and decrease when the total is high (I do want to trigger when 100 out of 10000 messages were not delivered, 1%). This is my query: ... | bin _time span=1h | stats count(eval(status=="undelivered" OR status=="failed")) as undelivered count as all by _time | eval percent=undelivered/all*100 | bin _time span=1d | streamstats window=100 avg(percent) as avg stdev(percent) as stdev by _time | eval upperBound=(avg+stdev*2) | eval isOutlier=if(percent > upperBound AND undelivered >= 50, upperBound, 0) | fields "_time", "percent", "upperBound", "avg", "stdev", "isOutlier", "all", "undelivered" The query is for one country, but I will finish this one and create it for all countries. Also you can see I inserted a minimum of 50 undelivered so it will never trigger below that. I know I can do it with splunk ML toolkit but currently I can't install it on our machine. Any help will do. Adding some graphs for reference of one country: This is the total delivered: This is the percent of undelivered: Thanks!! (If you need any more graphs just say. It wouldn't let me upload more images in the question.)

nmayafit · ‎11-13-2017

Great catch. REALLY not according to splunk's docs ([\s] etc.)

nmayafit · ‎11-13-2017

Hi, I have log line according to the next template: [2017-11-03 13:55:52,945] [MYPROJ] [EMAIL=xxx@yyy.com] But I want to find users (EMAIL) where the user inserted a whitespace at the start/end of the email: [2017-11-03 13:55:52,945] [MYPROJ] [EMAIL=xxx@yyy.com ] <- notice the end of the email Somehow no regex will find it. Is there something in the splunk admin conf that will trim the whitespace automatically? Thanks

nmayafit · ‎04-20-2017

Update: I found that the problem is that I used a real time schedule. When I changed it to cron schedule (every min) everything started working fine.

nmayafit · ‎04-19-2017

I see the same time range on both.

nmayafit · ‎04-19-2017

When I get from the "view results" it says only 1 result. When I do the same search again it gives me millions. How can it be?

nmayafit · ‎04-19-2017

The alert and the manual search both look at the last 2 hours. As I said, I take the exact search that I get from the "View Results" and run it again. Same query, same time range. Different results.

nmayafit · ‎04-19-2017

Hi, I have a very strange issue and I'm trying to solve it in the last week with no luck. I have an alert created from a percentage error rate of my server. The search is simple: host=*-prod* source="/var/log/xxx" | stats count as All, count(eval(level="ERROR")) as ERROR | eval Alert=((ERROR/All)*100) | table Alert | where Alert >= 0.3 But, the alert is triggering false positive all the time. Now, what strange is that when I push the "View Results" from email I see the false result (e.g 0.4), but when I just search the same search (just hit enter in the search field right after) I then get the right result (e.g 0.1). These are my alert configurations: Is this a bug? Am I doing something wrong?

nmayafit · ‎03-15-2016

For example: [2016-03-11 03:37:14,190] *!* [thread=http-exec-31] *!* [level=INFO ] *!* [web_session_id=webs_6PfJX-HexeqImBTKw0HFdHPO2KcxTi4K8131_HUksHY] *!* body=[Message is sent] environment=production [2016-03-11 03:37:21,818] *!* [thread=http-exec-11] *!* [level=INFO ] *!* [web_session_id=webs_6PfJX-HexeqImBTKw0HFdHPO2KcxTi4K8131_HUksHY] *!* body=[Data for flow GetFormRequestHandler inited] environment=production [2016-03-11 03:37:14,190] *!* [thread=http-exec-31] *!* [level=INFO ] *!* [web_session_id=webs_cPffz7DVqzGMhAIbE76snGmSCvuQi] *!* body=[Message is sent] environment=production [2016-03-11 03:37:14,190] *!* [thread=http-exec-31] *!* [level=INFO ] *!* [web_session_id=webs_cPffz7DVqzGMhAIbE76snGmSCvuQi] *!* body=[This is a session I don't want] environment=production [2016-03-11 03:37:21,818] *!* [thread=http-exec-11] *!* [level=INFO ] *!* [web_session_id=webs_cPffz7DVqzGMhAIbE76snGmSCvuQi] *!* body=[Data for flow GetFormRequestHandler inited] environment=production As you can see I have two batches of logs. The first two logs with the same web_session_id and the last 3 with a different session. Now, in the second batch I have a message in the body stating that I don't want this session. My desire is to dismiss those last 3 logs from my search and leave only the first two by using this body=[This is a session I don't want] in the log. So, at the end I will have something like this: [2016-03-11 03:37:14,190] *!* [thread=http-exec-31] *!* [level=INFO ] *!* [web_session_id=webs_6PfJX-HexeqImBTKw0HFdHPO2KcxTi4K8131_HUksHY] *!* body=[Message is sent] environment=production [2016-03-11 03:37:21,818] *!* [thread=http-exec-11] *!* [level=INFO ] *!* [web_session_id=webs_6PfJX-HexeqImBTKw0HFdHPO2KcxTi4K8131_HUksHY] *!* body=[Data for flow GetFormRequestHandler inited] environment=production Than After I use "transaction" on the session I will get: [2016-03-11 03:37:14,190] *!* [thread=http-exec-31] *!* [level=INFO ] *!* [web_session_id=webs_6PfJX-HexeqImBTKw0HFdHPO2KcxTi4K8131_HUksHY] *!* body=[Message is sent] environment=production [2016-03-11 03:37:21,818] *!* [thread=http-exec-11] *!* [level=INFO ] *!* [web_session_id=webs_6PfJX-HexeqImBTKw0HFdHPO2KcxTi4K8131_HUksHY] *!* body=[Data for flow GetFormRequestHandler inited] environment=production

nmayafit · ‎03-15-2016

Hi, I'm trying to create a complicated query but can't find how. Scenario: each log from the server contains a session ID I can use in my searches so I can gather all the same session logs into one transaction. I run a query that will result with batches of logs, each batch with a different session ID. Now, I want to remove the batches that one of the log lines in them contains some string. By this will remain only the "good" sessions that succeeded and not the ones that failed. Any idea? Thanks

Posts	14
Solutions	1
Karma Given	1
Karma Received	0
Member Since	‎03-14-2016

Online Status	Offline
Date Last Visited	‎03-22-2023 01:21 AM

How to filter logs with different and same fields?

Splunk complicated statistical outliers from a cha...

Regex for extracting email with a trailing whitesp...

Why is my alert triggering false positives?

Trying to create a complicated query with no luck

Re: Filter logs with different and same fields

Re: Filter logs with different and same fields

Re: Filter logs with different and same fields

How to filter logs with different and same fields?

Splunk complicated statistical outliers from a cha...

Re: Regex for extracting email with a trailing whi...

Regex for extracting email with a trailing whitesp...

Re: Why is my alert triggering false positives?

Re: Why is my alert triggering false positives?

Re: Why is my alert triggering false positives?

Re: Why is my alert triggering false positives?

Why is my alert triggering false positives?

Re: Trying to create a complicated query with no l...

Trying to create a complicated query with no luck