Hi all, I want to extract fields form log events. I have two errors patterns : EDICPP 4-1-1-0 exception: Mandatory element is missing. Error at <src/CBRSegmentDecoders.cpp:21405 Error in segment CSC 06 1 1A TKA in element #2. ------ Error at <src/CBRMessageDecoders.cpp:121 Error in group Group id: _294728_G_CBR in element #3. ------ Decoding error in message AIRRQT 15 2 1A PNR in element #4 at character 240 of the buffer, using charset B Converted segments: ORG - BLK - AMD - AVC - BIN - Cannot convert CSC from here==>+9998WSSU'Last segment correctly processed: CSC+7906:/++9998WSSU' and Can't find the UNH segment. What i want is to create a field named grammar_error_reason that contain exactly "Can not convert FOO" or "Can't find the FOO segment". Here is my rex command : (Converted segments:(\s\w{3}+\s-)+\s|)(?<grammar_error_reason>.+) (from here|segment\.) Can you help me please. Kind regards, Clement ... View more

Hi all, I have two date fields extracted (with regex) from log files. starting_collection_timestamp = Thu Oct 17 22:40:10 GMT 2019 end_collection_timestamp = Thu Oct 17 22:40:21 GMT 2019 I tried to know the exact type for this fields with the command : | makeresults | eval t=typeof(starting_collection_timestamp) Here is the result : _time | t 2019-11-29 08:56:43 Invalid When i tried to calculate the elapsed time between starting_collection_timestamp and end_collection_timestamp i have an empty field. I tried to change the type with the command strptime without sucess. | eval strptime('starting_collection_timestamp', "%a %b %d %H:%M:%S %Z %Y") Thank you for your help. ... View more

Hi all, I have extracted a field (exit_status) in log file. I want to know if a process exit properly. I have 3 use cases that can be found in log files, exit_status = normaly, exit_status= -1 or exit_status not exist. I want to have a visualisation wich count the number of exit_status = normaly and the number of file that not exit normaly ( exit_status = -1 + exit_status do not exist) I don't know how to create a counter of existing value (-1) plus the number of file where exit_status do not exist. ... View more

Hi all, I'm trying to generate a timechart wich expose execution duration of a file. I almost succeed but i'm not able to generate an X axis with tiimestamp visible. Is it possible ? index="saplogs" sourcetype=SAPCARBOOKING source="CARBOOKING.*.log" | stats min(_time) as start max(_time) as end by source | eval duration=end-start | eval start=strftime(start, "%Y-%m-%d %H:%M:%S") | eval end=strftime(end, "%Y-%m-%d %H:%M:%S") | stats avg(duration) as Duration by end, source | rename end as "End of processing date" In stats line i sort by end date and source. Because i want to see the source concerned by the duration field. Thank you for your help. ... View more

Hi all, I'm currently monitoring log files. I have exctrated 2 fields end_collection_timestamp & starting_collection_timestamp. I want to calculate duration of execution. | eval duration = end_collection_timestamp - starting_collection_timestamp But this method do not work because every lines with field end_collection_timestamp do not contain the fields starting_collection_timestamp. I do not understand all but i think this is the root cause. The result i want is a timechart with avg duration by day & source. Thanks for your help ... View more

Hi, I'm currently monitoring log files on unix server. Jobs application write log file in a directory. I want to monitor only log file that is finished to be write. How i can do that ? I don't want splunk to compare the beginning of the file to know if a file was already send to the indexer because if new lines are added to this file the forwarder will not see it. If the forwarder compare last lines to see if a file is new, it will sent the same file multiple time rights ? Can you help me please ? ... View more