Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jaango123
jaango123
Engager
Member since:
08-03-2017
11-02-2020
Community Statistics
| Posts | 10 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 08-03-2017 |
Activity Feed
- Posted Response time, error count, transaction per second in one graph on Splunk Search. 10-27-2020 10:32 PM
- Karma Re: Statistics based on regex and quotes for richgalloway. 06-05-2020 12:49 AM
- Posted Re: Grouping based on Regex and occurences of language on Splunk Search. 08-07-2017 12:11 AM
- Posted Re: Grouping based on Regex and occurences of language on Splunk Search. 08-05-2017 12:56 AM
- Posted Re: Grouping based on Regex and occurences of language on Splunk Search. 08-04-2017 05:44 AM
- Posted Re: Grouping based on Regex and occurences of language on Splunk Search. 08-04-2017 05:42 AM
- Posted Re: Grouping based on Regex and occurences of language on Splunk Search. 08-04-2017 05:40 AM
- Posted Grouping based on Regex and occurences of language on Splunk Search. 08-04-2017 03:37 AM
- Tagged Grouping based on Regex and occurences of language on Splunk Search. 08-04-2017 03:37 AM
- Tagged Grouping based on Regex and occurences of language on Splunk Search. 08-04-2017 03:37 AM
- Posted Re: Statistics based on regex and quotes on Splunk Dev. 08-04-2017 12:16 AM
- Posted Re: Statistics based on regex and quotes on Splunk Dev. 08-03-2017 07:51 AM
- Posted Statistics based on regex and quotes on Splunk Dev. 08-03-2017 02:35 AM
- Tagged Statistics based on regex and quotes on Splunk Dev. 08-03-2017 02:35 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
10-27-2020
10:32 PM
I would like to get response time(95 percentile), error count and transaction per second in one graph timechart. This way I can check all details like at what point of tps the response time increases, error count increases etc. currently i get the tps as follows search all | eval count=1 | timechart per_second(count) as transactions_per_second error count search - NOT status="200" response time - p95(Response_Time)
... View more
08-07-2017
12:11 AM
Awesome... Yeah this one worked.
... View more
08-05-2017
12:56 AM
It is there in the above example - ..............,rest="GET http://salo/vbghj/gr/gr/val/prot/34567",Rwe="",Notice="",GH="version 1.1"
... View more
08-04-2017
05:44 AM
Thanks Here above is the sample that can be used. My first query worked. However I wanted to group the Language(regex) and get the count of it.
The second query when I try I get - The output field 'Language' cannot have the same name as a group-by field
... View more
08-04-2017
05:42 AM
Aug 03 07:53:34 servername_APP_LOG [IN_PROD][12345678][APP_LOG][note] abc(NewService): Id(125678)[RESP][1.2.3.4] Globid(45678912): REQ=ABC.ElectronicsService,Customer=JIKL,NUM=34872,HTTPRES="200 OK",Fromcache=true,Result="",Op_name=ABCElectronicsService.getallpages.v1.0,Receive=Accepted,Policy=onepermin,Value=345,time=1,spent=2,Size=2,RspSize=123,Format=json,Actual=,remaining=2.3.4.5,rest="GET http://salo/vbghj/gr/gr/val/prot/34567",Rwe="",Notice="",GH="version 1.1"
... View more
08-04-2017
05:40 AM
Yeah... But that failed saying Language cannot be used as it is same as the field name.
" The output field 'Language' cannot have the same name as a group-by field"
... View more
08-04-2017
03:37 AM
Hi,
I am new to Splunk and I managed to construct the below query to generate statistics with the help of the answer from richgalloway user.
I just want to group by the language and calculate the count of such occurences.
sample log, the url link starts with http, as I cant post any links directly now.
Aug 03 07:53:34 servername_APP_LOG [IN_PROD][12345678][APP_LOG][note] abc(NewService): Id(125678)[RESP][1.2.3.4] Globid(45678912): REQ=ABC.ElectronicsService,Customer=JIKL,NUM=34872,HTTPRES="200 OK",Fromcache=true,Result="",Op_name=ABCElectronicsService.getallpages.v1.0,Receive=Accepted,Policy=onepermin,Value=345,time=1,spent=2,Size=2,RspSize=123,Format=json,Actual=,remaining=2.3.4.5,Rest="GET url starting with http/salo/vbghj/gr/gr/val/prot/34567",Rwe="",Notice="",GH="version 1.1"
My current query(query is fine) by the help of richgalloway user in my previous question
"[APP_LOG]" "[IN_PROD]"
| rex "https?:\/\/.*?\/.*?\/(?<language>\w\w\/\w\w)\/"
| rex "rest=\"(?<Request>\w+)"
| stats count as RequestCount count(Customer=*) count(eval(HTTPRES="200 OK")) as SuccessCount count(eval(HTTPRES!="200 OK")) as FailureCount values(language) as Language values(Request) as Request by Customer, REQ
| table Customer, REQ, RequestCount, SuccessCount, FailureCount, Request, Language
I would like to get the table as follows, difference is just to get the count based on language instead of Requestcount and get the corresponding language.
Customer REQ Countperlanguage SuccessCount Failure Request Language
JIKL ABC.ElectronicsService 3 5 3 2 GET gr/gr
Tried like below grouping but it dint work.
"[APP_LOG]" "[IN_PROD]"
| rex "https?:\/\/.*?\/.*?\/(?<language>\w\w\/\w\w)\/"
| rex "rest=\"(?<Request>\w+)"
| stats count as RequestCount count(Customer=*) count(eval(HTTPRES="200 OK")) as SuccessCount count(eval(HTTPRES!="200 OK")) as FailureCount values(language) as Language values(Request) as Request by Customer, REQ, Language
| stats count as langcount count(Language)
| table Customer, REQ, langcount, SuccessCount, Failure, Request, Language
... View more
- Tags:
- grouping
- statistical
08-04-2017
12:16 AM
Thanks.. It shows how to use Regex and to group fields. Can you please let me know how to modify this so that i can group by Language as well. I get an error "The output field cannot have the same name Language as the group by field"
... View more
08-03-2017
07:51 AM
Thanks.. I will try this. However the FailureCount is same as Successcount?
... View more
08-03-2017
02:35 AM
Hi,
I am new to Splunk and I managed to construct the below query to generate statistics(getting count of customers grouped by REQ). However I wanted to add four more columns with count values.
One for Success, one for failure, one for type of request(GET/POST etc), one for language
Success count should be counted based on HTTPRES="200 OK".
For failure count the above will anything other than 200
Request should be whether it is GET/POST etc. Obtained from Rest="GET h t t p ://.........". The characters after Rest="
Langage is the trickiest part. We need to extract 'gr/gr' from this url url starting with http/somealphabets/alphabets/gr/gr/....continues.
sample log, the url link starts with http, as I cant post any links directly now.
Aug 03 07:53:34 servername_APP_LOG [IN_PROD][12345678][APP_LOG][note] abc(NewService): Id(125678)[RESP][1.2.3.4] Globid(45678912): REQ=ABC.ElectronicsService,Customer=JIKL,NUM=34872,HTTPRES="200 OK",Fromcache=true,Result="",Op_name=ABCElectronicsService.getallpages.v1.0,Receive=Accepted,Policy=onepermin,Value=345,time=1,spent=2,Size=2,RspSize=123,Format=json,Actual=,remaining=2.3.4.5,Rest="GET url starting with http/salo/vbghj/gr/gr/val/prot/34567",Rwe="",Notice="",GH="version 1.1"
My cuurent query(query is fine)
"[APP_LOG]" "[IN_PROD]"
| stats count as RequestCount count(Customer=*) by Customer, REQ
| table Customer, REQ, RequestCount
yields
Customer REQ RequestCount
JIKL ABC.ElectronicsService 5
Wanted like below table. Sorry for bad formatting
Customer REQ RequestCount SuccessCount Failure Request Language
JIKL ABC.ElectronicsService 5 3 2 GET gr/gr
... View more
- Tags:
- statistics
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-02-2020
06:27 AM
|
