About vickycoder27

vickycoder27 · ‎07-16-2020

@to4kawa Much cleaner approach, I will try to explore more of spath().

vickycoder27 · ‎07-15-2020

I have a curl response which is json string[], I am able to fetch the data using split(), mvexpand() and then substring. But the problem with substring is, if the sequence of value for a key changes then result is not correct. Tried mvindex on the manipulated data but it doesn't work or rex, not sure if I am doing any thing wrong. Below is my log and I am interested in "Response []" from which I want to pull userId i.e. 9401850890, 9801850840, 9801850841. APIName=TestApi, HTTP_STATUS=200, totalTime=2346, Response=[{"id":11168715,"state":"Open","title":"TESTS NOTIFICATION - SPIKE IN USEAGE userId : 9401850890"},{"id":11168716,"state":"Closed","title":"TESTS NOTIFICATION - SPIKE IN USEAGE userId : 9801850840"},{"id":21172617,"state":"Verify","title":"TESTS NOTIFICATION - SPIKE IN USEAGE userId : 9801850841"}] Query that I tried : index=api_stats source=apistats earliest=-10m@m latest=-0m@m | eval x=ltrim(Response,“[”) | eval n=rtrim(x, “]”) | eval temp=split(n,“}”)| mvexpand temp| eval y=ltrim(temp,“,”) | eval testData=mvindex(y,-1) | eval testId=substr(testData, 7, 9)| eval apiCallerID=substr(testData, 92, 10) | table testData,testId,apiCallerID

vickycoder27 · ‎11-25-2019

P.S. I can send email dynamically, thats not the issue but the problem is using the Action "Log Event" along with it. If you have any idea how to achieve that at the same time, for now I am using send mail for each result and that seems to be bailing me out but still wanted to resolve this.

vickycoder27 · ‎11-20-2019

I have an alert that creates a table and has emailed, user id, endpoint, count in the result which is used with |map() & |send() function to dynamically generate the emails. I also needed this metadata information to check which user I had sent out emails so I had Action ->Log Event, but the problem is Log Event will happen only if the final result is a table but breaks if its |map(). Action->Send email works for only static emails. How do I achieve this to Log Event + use map() to send out emails dynamically?

vickycoder27 · ‎04-09-2019

Kind or partially worked with below regex(except the special characters like % ! $) :"\/my-list\/my-group\/\w+.*"

vickycoder27 · ‎04-09-2019

We have some below Regex patterns that have special characters, alphabets & digits and wanted them as a showing up as a single url in Dashboard as "/my-list/my-group/fetchGroup": url=/my-list/my-group/MY_SPL_%26%5E%26%25%5E%26%23%25%24%5E%26%25%26%2A%25%2B%29%21%24%23%24%25%26%5E_new url=/my-list/my-group/MY_SafeList_automation url=/my-list/my-group/RfdL4fSjmS url=/my-list/my-group/Bug%20May%20Be%20User%20Notification I wrote one for digits as below and wanted for combination of special characters, alphabets & digits ( url="bug/364756748/types" --->>> eval url=replace(url,"\/bug\/\d+.*\/types","bug/types") )

Posts	6
Solutions	0
Karma Given	3
Karma Received	0
Member Since	‎04-09-2019

Online Status	Offline
Date Last Visited	‎07-16-2020 06:01 AM

Fetch data from json string[]

How to LogEvent action for an alert as well as sen...

Regex pattern for url patterns to show as a single...

Re: Fetch data from json string[]

Fetch data from json string[]

Re: How to LogEvent action for an alert as well as...

How to LogEvent action for an alert as well as sen...

Re: Regex pattern for url patterns to show as a si...

Regex pattern for url patterns to show as a single...