Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About le_barbucheron
le_barbucheron
Path Finder
Member since:
05-17-2019
06-05-2020
Community Statistics
| Posts | 17 |
| Solutions | 1 |
| Karma Given | 15 |
| Karma Received | 0 |
| Member Since | 05-17-2019 |
Activity Feed
- Karma Re: How many time a string occurs in a transaction and not the number of events that string appear for Sukisen1981. 06-05-2020 12:50 AM
- Karma Re: How many time a string occurs in a transaction and not the number of events that string appear for Sukisen1981. 06-05-2020 12:50 AM
- Karma Re: How many time a string occurs in a transaction and not the number of events that string appear for Sukisen1981. 06-05-2020 12:50 AM
- Karma Re: How many time a string occurs in a transaction and not the number of events that string appear for DavidHourani. 06-05-2020 12:50 AM
- Karma Re: How many time a string occurs in a transaction and not the number of events that string appear for DavidHourani. 06-05-2020 12:50 AM
- Karma Re: How many time a string occurs in a transaction and not the number of events that string appear for Sukisen1981. 06-05-2020 12:50 AM
- Karma Re: How many time a string occurs in a transaction and not the number of events that string appear for DavidHourani. 06-05-2020 12:50 AM
- Karma Re: How many time a string occurs in a transaction and not the number of events that string appear for Sukisen1981. 06-05-2020 12:50 AM
- Karma Re: How many time a string occurs in a transaction and not the number of events that string appear for DavidHourani. 06-05-2020 12:50 AM
- Karma Re: How to create a regex to extract values from an event? for harshpatel. 06-05-2020 12:50 AM
- Karma Re: How to create a regex to extract values from an event? for martynoconnor. 06-05-2020 12:50 AM
- Karma Re: How to create a regex to extract values from an event? for mydog8it. 06-05-2020 12:50 AM
- Karma Re: How to create a regex to extract values from an event? for woodcock. 06-05-2020 12:50 AM
- Karma Re: How to create a regex to extract values from an event? for harshpatel. 06-05-2020 12:50 AM
- Karma Re: How to create a regex to extract values from an event? for harshpatel. 06-05-2020 12:50 AM
- Posted Re: How to create a regex to extract values from an event? on Splunk Search. 06-06-2019 04:50 AM
- Posted Re: How to create a regex to extract values from an event? on Splunk Search. 06-06-2019 01:42 AM
- Posted Re: How to create a regex to extract values from an event? on Splunk Search. 06-06-2019 01:34 AM
- Posted Re: How to create a regex to extract values from an event? on Splunk Search. 06-06-2019 12:12 AM
- Posted Re: How to create a regex to extract values from an event? on Splunk Search. 06-05-2019 06:37 AM
Topics I've Started
06-06-2019
04:50 AM
yes their is this two possibilities and your expression :
"\\\\x\d\d;\d\s(?<first>\d)(?<second>\d)"
Work very well !!! thank you so much !
Can you please re-send it so i can accept it ? 🙂
... View more
06-06-2019
01:42 AM
Thank you everybody, I think i'm going to use the regex wrote by @martynoconnor with the fillnull command to place the "0" values skipped,
Again, thank you so much !
... View more
06-06-2019
01:34 AM
Oops sorry i was wrong, when the value of the field are different of 0 their is no space but when the first are the second are at 0 their is a space, like this :
0 4 0 0 0 0 0 0 8 0 0 0 0 0 0 0 2 D8 B0
0 44 0 0 0 0 0 8 0 0 0 0 0 0 0 2 D8 B0
... View more
06-06-2019
12:12 AM
Their is no space between the two value I need to extract, they'll always be grouped like my example
... View more
06-05-2019
06:37 AM
Sure, I tried your answer but i don't know why this don't work on my events but this work perfectly on regex101
... View more
06-05-2019
06:06 AM
Sorry, guys I don't know why I didn't get any notifications of your reply,
Here's some more samples :
2019-05-02 08:29:05.225;2019-05-02 08:29:05.225;2019-05-02 07:29:05.225;LOOKINGFORACTION;TO;SOMESTRING;FROM;SOMESTRING;MSG [223];\x00;5 52 0 0 0 0 0 8 0 0 0 0 0 0 0 2 FC 3E ;\x00;\x00;\x00;0;0
2019-05-03 09:32:12.552;2019-05-03 09:32:12.552;2019-05-02 09:32:12.552;LOOKINGFORACTION;TO;SOMESTRING;FROM;SOMESTRING;MSG [223];\x00;1 73 0 0 0 0 0 8 0 0 0 0 0 0 0 C CD 39 ;\x00;\x00;\x00;0;0
2019-05-03 10:17:15.355;2019-05-03 10:17:15.355;2019-05-03 10:32:15.355;LOOKINGFORACTION;TO;SOMESTRING;FROM;SOMESTRING;MSG [223];\x00;0 02 0 0 0 0 0 8 0 0 0 0 0 0 0 1 89 10 ;\x00;\x00;\x00;0;0
2019-05-03 11:16:03.012;2019-05-03 11:16:03.012;2019-05-03 11:16:06.012;LOOKINGFORACTION;TO;SOMESTRING;FROM;SOMESTRING;MSG [223];\x00;0 40 0 0 0 0 0 8 0 0 0 0 0 0 0 2 D8 B0 ;\x00;\x00;\x00;0;0
I tried the 3 propositions you made me and only the expression writed by @martynoconnor get me a result but this result return me an empty value when the first number extracted is "0"
Thank you for your answers ! 🙂
... View more
06-03-2019
01:22 AM
Hi everyone,
I'm struggling to find a REGEX to extract 2 value from my events.
I got events like this :
2019-05-02 07:26:07.283;2019-05-02 05:26:07.283;2019-05-02 07:26:07.283;LOOKINGFORACTION;TO;SOMESTRING;FROM;SOMESTRING;MSG [223];\x00;0 22 0 0 0 0 0 8 0 0 0 0 0 0 0 2 FC 3E ;\x00;\x00;\x00;0;0
I was looking for a REGEX to extract this two values :
0 2 2 0 0 0 0 0 8 0 0 0 0 0 0 0 2 FC 3E
and
0 2 2 0 0 0 0 0 8 0 0 0 0 0 0 0 2 FC 3E
But I don't know how write the right REGEX.
Thank you for reading and thank you in advance for your answers.
... View more
05-20-2019
05:57 AM
I tried your regex improvement but i don't know why, this gave me no result,
Thank you so much again 🙂
Cheers
... View more
05-20-2019
05:41 AM
Thank you guys with your help I found the answer !
|rex field=_raw "A_FAILURE_LEVEL;([^;])+;([^;])+;([^;])+;([^;])+;([^;])+;([^;])+;(?<state>.*)" max_match=0
|mvexpand state
|stats count by Equipement, state
and untable/fields - the state i don't want
Thank you so much for your help @DavidHourani and @Sukisen1981 !!
... View more
05-20-2019
04:42 AM
Hi,
I tried your query and I got not result, but when i use :
|rex field=_raw "FAILURE_LEVEL;([^;])+;([^;])+;([^;])+;([^;])+;([^;])+;([^;])+;(?<state>.*)" max_match=0
| table state
I got the right state in the table
so now I just got to count the number of time the state I want is in the table
... View more
05-20-2019
02:27 AM
Hi again @DavidHourani
I tested it and again Splunk return me no results, maybe because their is 6 ";" between "Failure_LEVEL" and the state "NOT_OK" like this
2019-04-11 19:08:48.230;2019-04-11 17:08:48.230;2019-04-11 19:08:48.230;Machine1_A_FAILURE_LEVEL;XXX;XXX;XXX;XXX;XXX;XXX;NOT_OK;\x00;\x00;\x00;0;0
So I tried :
|rex field=_raw "FAILURE_LEVEL;([^;])+;([^;])+;([^;])+;([^;])+;([^;])+;([^;])+;(?<failed>.*);" max_match=0
|mvexpand failed
|stats count by failed,Equipement, New_State
|where failed="NOT_OK"
But again no result 😕
... View more
05-20-2019
01:18 AM
Hi @Sukisen1981,
I tried your query and that return me the number of time the string "FAILURE_LEVEL" occurs and that nearly what I wanted 🙂
How can I modify your query to be more precise on the string searched ?
thx for your answers
... View more
05-20-2019
01:12 AM
Hi @DavidHourani ,
I tried your query but that returns me no results ,
and when i modify the query like this :
|mvexpand New_State
|stats count by Equipement, New_State
|where New_State="NOT_OK"
Thx for your answer 🙂
Because my failure_level is in the extracted field "New_State", and i'm really bad with REGEX, that return me again the number of events that field occurs and not the number of occurence of the value "NOT_OK"
... View more
05-19-2019
11:04 PM
Their is two statement possible :
-Ok
-Not_ok
And the statement Not_ok for the machine1_A and machine1_B appear 1 time in the first transaction and 2 time in the second, that's why I wanted to count 3 for each
... View more
05-19-2019
01:50 AM
Thank for your quick aswer, i'll try this tomorrow because i don't have acces to my splunk instance now.
In fact what I desire it's when I got multiple transactions like this :
05/18/2019 17:08:322;SOME STRING;MACHINE1_STATE;READY;
05/18/2019 18:05:355;SOME STRING;Nameofthemachine_Machine1_A_FAILURE_LEVEL;XXX;OK;
05/18/2019 18:22:460;SOME STRING;Nameofthemachine_Machine1_B_FAILURE_LEVEL;XXX;OK;
05/18/2019 19:48:127;SOME STRING;Nameofthemachine_Machine1_A_FAILURE_LEVEL;XXX;NOT_OK;
05/18/2019 21:05:237;SOME STRING;Nameofthemachine_Machine1_B_FAILURE_LEVEL;XXX;NOT_OK;
05/18/2019;SOMESTRING;MACHINE1_STATE;NOT_READY;
05/16/2019 10:07:254;SOME STRING;MACHINE1_STATE;READY;
05/16/2019 11:12:523;SOME STRING;Nameofthemachine_Machine1_A_FAILURE_LEVEL;XXX;OK;
05/16/2019 12:27:520;SOME STRING;Nameofthemachine_Machine1_B_FAILURE_LEVEL;XXX;OK;
05/16/2019 13:58:454;SOME STRING;Nameofthemachine_Machine1_A_FAILURE_LEVEL;XXX;NOT_OK;
05/16/2019 20:23:258;SOME STRING;Nameofthemachine_Machine1_B_FAILURE_LEVEL;XXX;NOT_OK;
05/17/2019 16:07:145;SOME STRING;Nameofthemachine_Machine1_A_FAILURE_LEVEL;XXX;OK;
05/17/2019 16:22:220;SOME STRING;Nameofthemachine_Machine1_B_FAILURE_LEVEL;XXX;OK;
05/17/2019 17:48:235;SOME STRING;Nameofthemachine_Machine1_A_FAILURE_LEVEL;XXX;NOT_OK;
05/17/2019 23:08:652;SOME STRING;Nameofthemachine_Machine1_B_FAILURE_LEVEL;XXX;NOT_OK;
STRING;Nameofthemachine_Machine1_A_FAILURE_LEVEL;XXX;OK;
05/17/2019;23:53:232;SOMESTRING;MACHINE1_STATE;NOT_READY;
I got in return :
Machine1_A_Fail : 3
Machine1_B_Fail : 3
And in fact splunk return :
Machine1_A_Fail : 2
Machine1_B_Fail : 2
Because he counts the 2 transactions and not the 3 occurrence of the string
... View more
05-19-2019
01:15 AM
Yes due to the transaction my events are grouped in one and looks like that :
05/18/2019 17:08:322;SOME STRING;MACHINE1_STATE;READY;
05/18/2019 18:05:355;SOME STRING;Nameofthemachine_Machine1_A_FAILURE_LEVEL;XXX;OK;
05/18/2019 18:22:460;SOME STRING;Nameofthemachine_Machine1_B_FAILURE_LEVEL;XXX;OK;
05/18/2019 19:48:127;SOME STRING;Nameofthemachine_Machine1_A_FAILURE_LEVEL;XXX;NOT_OK;
05/18/2019 21:05:237;SOME STRING;Nameofthemachine_Machine1_B_FAILURE_LEVEL;XXX;NOT_OK;
05/18/2019;SOMESTRING;MACHINE1_STATE;NOT_READY;
... View more
05-17-2019
07:29 AM
Hi,
I've got a machine splitted in two unit A and B who gave me their state of preparation and their Failure level. I wanted to count the number of failure per unit when the unit is ready.
So, i created a transaction to group my event when my machine is ready and tried to count the number of time my machine wasn't OK, but every query i tried return me the number of event and not the number of time the string i was looking for occurs.
This is my base search :
(index="index1") Equipement="Machine1" (New_State=ready OR New_State=Not_ready OR id ="*Machine1_B_FAILURE_LEVEL" OR id ="*Machine_A_FAILURE_LEVEL") | transaction Equipement host startswith="New_State="Ready" endswith="New_State=Not_ready"
And I tried :
stats count by Equipement, New_State limit=100
And :
|eval Failure_machine1_A=if(searchmatch(".*machine1_A_FAILURE_LEVEL") AND (searchmatch("Not_ok"),1,Failure_machine1_A) | | transaction Equipement host startswith="New_State=Ready" endswith="New_State=Not_ready"
| stats sum(Failure_machine1_A) by Equipement
also :
| transaction Equipement host startswith="New_State=Ready" endswith="New_State=Not_ready"
|eval Failure_machine1_A=if(searchmatch(".*machine1_A_FAILURE_LEVEL") AND (searchmatch("Not_ok"),1,Failure_machine1_A) | stats sum(Failure_machine1_A) by Equipement
And :
|eval Failure_machine1_A=if((match(id,".*Machine1_A_FAILURE_LEVEL") AND match(_raw, "NOT_OK" )),1,Failure_machine1_A )| transaction Equipement host startswith="New_State=Ready" endswith="New_State=Not_Ready"|
stats count(Failure_machine1_A) by Equipement
And the last try :
|eval Failure_machine1_A=if(like(id,"*Machine1_A_FAILURE_LEVEL") AND New_State=Not_ok,1,Failure_machine1_A )| transaction Equipement host startswith="New_State=Ready endswith="New_State=Not_Ready"|
stats count(Failure_machine1_A) by Equipement
I also tried to use some subsearch without success.
As a beginner, I don't know what I can try next or if I use the right method to achieve my goal.
Thank you in advance for your answers and sorry for my english.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
