About abhishekbhasin

abhishekbhasin · ‎09-09-2022

Thanks!. It works

abhishekbhasin · ‎09-08-2022

Full syntax please rex max_match=3 ... (?<Par>P[1-9][0-9]*) doesn't work

abhishekbhasin · ‎09-08-2022

Need to extract P302 P1 P2 with a single regular ex I build (?<Par>P[1-9][0-9]*) but when I run this in splunk it only captures first (P302) [SearchBroker - XXX] - [submitSearch] INFO: XXX [] - submitSearch time=36 pTime={P302=11,P1=7,P301=13,P2=24,P3=23,P4=31,P5=25,P6=23,P300=13,P7=23,P8=24,P9=24,P10=21,P12=24,P11=23,P1000=1,P14=26,P13=24,P16=21,P15=20,P18=20,P17=23} pProcessTime={P302p=10,P1p=6,P301p=12,P2p=23,P3p=22,P4p=30,P5p=24,P6p=23,P300p=13,P7p=23,P8p=24,P9p=24,P10p=21,P12p=23,P11p=22,P1000p=0,P14p=26,P13p=23,P16p=20,P15p=20,P18p=20,P17p=23} pWaitTime=

abhishekbhasin · ‎10-31-2019

Able to get the data with above mentioned query but having trouble building alert since it's a custom alert. Could you please send syntax for this Condition 1: alert_a = 1 --> actions Condition 2: alert_b = 1--> actions

abhishekbhasin · ‎10-30-2019

Able to get the data with above mentioned query but having trouble building alert since it's a custom alert. Could you please send syntax for this Condition 1: alert_a = 1 --> actions Condition 2: alert_b = 1--> actions

abhishekbhasin · ‎10-29-2019

example in this case would be trigger an alert when avg(time) for A > 2 and count >3 then evaluate avg(time) for B >5 and count > 10. If all the conditions meets then only trigger an alert.

abhishekbhasin · ‎10-29-2019

Trying to setup up an alert with multiple fields extracted through Field. For example A,B, C etc and each having a different threshold for avg(time) and count. Below is an example: index=XXXX sourcetype="XXX" | where Field in("A") | stats count avg(time) as A | where A>2 and count>3| where Field in("B") |stats count avg(time) as B | where B>5 and count>10

Posts	7
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎10-29-2019

Online Status	Offline
Date Last Visited	‎09-09-2022 08:06 AM

How to capture Multiple values in single group via...

How to set up alerts with multiple fields with dif...

Re: Capturing Multiple values in single group via ...

Re: Capturing Multiple values in single group via ...

How to capture Multiple values in single group via...

Re: How to set up alerts with multiple fields with...

Re: How to set up alerts with multiple fields with...

Re: How to set up alerts with multiple fields with...

How to set up alerts with multiple fields with dif...