About Deprasad

Deprasad · ‎03-13-2024

Yes, I've hyphens and a full stop on the hostname that needs to be considered. So far identified those 4 patterns and that should be it.

Deprasad · ‎03-13-2024

Thanks a lot! This regex works for the given example. I've another pattern like this "address":"http://test-query-service.xxx-xxx.xxx.xxx.com/services/user/v1/deleteUser/342ad-123m4-r43rm-144dgdg" for which I'm trying to implement the regex you've given by modifying slightly but couldn't achieve the same result. Can you please help here? Also can you please break down the regex for my better understanding.

Deprasad · ‎03-13-2024

I've below 3 different types of API logs where I've to treat all 3 as same and get the count of the API. There are multiple versions of same API along with or without user guid which is a unique value. "address":"http://test/services/user/v1/deleteUser/342ad-123m4-r43rm-144dgdg "address":"http://test/services/user/v2/deleteUser/delete/342ad-123m4-r43rm-144dgdg "address":"http://test/services/user/v2/deleteUser Looing for a regex which reads the API until the alphanumeric string starts. In short , if I do stats count by API it should give the count as 3.

Deprasad · ‎07-13-2023

Thanks a lot! This works.

Deprasad · ‎07-13-2023

Can you please elaborate a bit more, if possible with XML.

Deprasad · ‎07-12-2023

I've a dashboard built with 3 panels with Panel 1 populate the date with loading at first time. Second panel will take input from 1st panel using drilldown and populate the data. Similarly, Third panel will take input from 2nd panel using drilldown and populate the data. Now if I click on different value from Panel 1, Panel 2 recognize that and it will refresh the result based on the input from Panel 1 but Panel 3 will remain display the result based on the previous input from Panel 2. Is there a way to overcome this issue like as soon as input for panel 2 changes, the panel 3 should disappear or it should change to " Search is waiting for input..."

Deprasad · ‎07-07-2023

Still the same format issue, where getting few rows of test request and then testresponse which has the logouttime as the last row. Interestingly I'm getting the desired result for below query with just adding the Join type as Left. It seems splunk takes Join type as Inner by default which gives results if there is a match between search and subsearch. index = test "testrequest" | rex "(?:.+email\=)(?<Email>[a-zA-Z0-9_\-\@\.]+)" | rex "(?:.+trasactionId\=)(?<TransactionID>[a-zA-Z0-9-]+)" | rex "(?:.+TransactionTime\=)(?<LoginTime>[a-zA-Z0-9\s:]+EDT)" | rex "(?:.+Status\=)(?<Status>\w+)" | rex "(?:.+TimeTaken\=)(?<TimeTaken1>\d+)" | eval TimeTaken=TimeTaken1/1000 | rex "(?:.+\+\+)(?<SessionID>[a-zA-Z0-9-_:@.]+)(?:\:Status)" | rex "(?:.+FailureReason\=)(?<FailureReason>[\w\s]+)" | table Email,TransactionID,LoginTime,Status,TimeTaken,SessionID | join type=left SessionID [search index = test "testresponse" | rex "(?:.+TransactionTime\=)(?<LogoutTime>[a-zA-Z0-9\s:]+EDT)" | rex "(?:.+SessionId\=)(?<SessionID>[a-zA-Z0-9-_:@.]+)(?:\:Status)" | table SessionID,LogoutTime ] | table Email,TransactionID,LoginTime,TimeTaken,SessionID,LogoutTime,Status,FailureReason Thanks for the wonderful conversation and help that led to this excellent learning.

Deprasad · ‎07-06-2023

The below query also works but its grouping the email,transactionid,logintime filed together in ascending order w.r.t the session ID causing mismatch between email,transactionid,logintime. index = test "testrequest" | rex "(?:.+email\=)(?<Email>[a-zA-Z0-9_\-\@\.]+)" | rex "(?:.+trasactionId\=)(?<TransactionID>[a-zA-Z0-9-]+)" | rex "(?:.+TransactionTime\=)(?<LoginTime>[a-zA-Z0-9\s:]+EDT)" | rex "(?:.+Status\=)(?<Status>\w+)" | rex "(?:.+TimeTaken\=)(?<TimeTaken1>\d+)" | rex "(?:.+\+\+)(?<SessionID>[a-zA-Z0-9-_:@.]+)(?:\:Status)" | table Email,TransactionID,LoginTime,Status,TimeTaken,SessionID | append [search index = test "testresponse" | rex "(?:.+TransactionTime\=)(?<LogoutTime>[a-zA-Z0-9\s:]+EDT)" | rex "(?:.+SessionId\=)(?<SessionID>[a-zA-Z0-9-_:@.]+)(?:\:Status)" | table SessionID,LogoutTime] | stats values(*) as * by SessionID | table Email,TransactionID,LoginTime,TimeTaken,SessionID,LogoutTime,Status

Deprasad · ‎07-06-2023

The Query works but some formatting is needed. For the test request I've multiple rows(Ex: multiple loginTime) and Test response will be only one(Ex: single logoutTime). So the output is coming like first few rows for request and the followed by response as last row. I need the output like something similar below: Email | transactionID | logintime | status | timetaken | sessionID | LogoutTime xxx xxxxxxxxxxx 02:10:00 xxxxx xxxxxxxx xxxxxxxxx 02:45:15 yyy yyyyyyyyyyy 02:15:15 yyyyy yyyyyyyy xxxxxxxxx 02:45:15 zzz zzzzzzzzzzz 02:25:15 zzzzz zzzzzzzz xxxxxxxxx 02:45:15 Test request event: Test request:email=xxxx:trasactionId=xxx-xxx-xxx-xxx-xxx:RequestType=dummy:TimeTaken=16209,TransactionTime=02:10:00:SessionId=xxxxxxx:Status=SUCCESS Test response event: Test response:email=yyyyyy:trasactionId=yyyyy-yyyyy-yyyy-yyyy-yyyyy:TimeTaken=381:TransactionTime=02:45:15: SessionId=xxxxxxx:Status=SUCCESS

Deprasad · ‎07-06-2023

The transaction ID is different for both the events, only common filed is "SessionID". there are few other fields which are common in name but has different values. The logic is, Single SessionID will have 'n' no of Email,TransactionID,LoginTime but only have one LogoutTime in a different event.

Deprasad · ‎07-06-2023

I'm still not getting the LogoutTime. Also please note that the field from first query such as Email, TransactionID, LoginTime will have multiple values. PFA.

Deprasad · ‎07-06-2023

I have 2 queries and joining it with "Join" using the common field "SessionID". With the below query I'm just getting the results if there are results from both the search. If there is no result for either the parent search or the sub search the result is not getting printed. For example if there is no LogoutTime available from the sub search, the results of parent search is not getting printed and. Is there any way to achieve the desired result. index = test "testrequest" | rex "(?:.+email\=)(?<Email>[a-zA-Z0-9_\-\@\.]+)" | rex "(?:.+trasactionId\=)(?<TransactionID>[a-zA-Z0-9-]+)" | rex "(?:.+TransactionTime\=)(?<LoginTime>[a-zA-Z0-9\s:]+EDT)" | rex "(?:.+Status\=)(?<Status>\w+)" | rex "(?:.+TimeTaken\=)(?<TimeTaken>\d+)" | rex "(?:.+\+\+)(?<SessionID>[a-zA-Z0-9-_:@.]+)(?:\:Status)" | table Email,TransactionID,LoginTime,Status,TimeTaken,SessionID | join SessionID [search index = test "testrespone" | rex "(?:.+TransactionTime\=)(?<LogoutTime>[a-zA-Z0-9\s:]+EDT)" | rex "(?:.+SessionId\=)(?<SessionID>[a-zA-Z0-9-_:@.]+)(?:\:Status)" | table SessionID,LogoutTime] | table Email,TransactionID,LoginTime,Status,TimeTaken,SessionID,LogoutTime

Deprasad · ‎05-02-2023

What is the equivalent Splunk Cron expression for the below Cron. 0 0 0 ? * 7#1 * An alert needs to be configured for every month 1st Saturday at 00:05 AM.

Deprasad · ‎10-07-2022

I have a query which displays top 10 consumed sourcetype. I would like to enable drilldown to achieve the below task. When user clicks on a particular row, it should open a new tab and a new query should get executed for each row. Right now, I have enabled Drilldown ->On Click-> Link to Search->Custom->Search String->Apply. In this way I can have the same query gets executed on selection of any rows. But I would like to define different queries for different rows based on the selection. Is this possible with Drilldown?

Deprasad · ‎08-30-2022

Thanks for this query @richgalloway ! It worked. Further I added the below piece of query to get the percentage. | eval Error_Percentage=round(100*count/Total_Transaction,2)."%" | table Error_Message,count, Error_Percentage

Deprasad · ‎08-30-2022

I've 2 queries, 1 will give the the total no of events and the other will give the counts by error type. I'm trying to join the two queries so that I can get the percentage of each error type. Query 1: index=app "ResponseLoggingFilter" "Operation" | stats count as Total_Transaction Query 2: index=app "ResponseLoggingFilter" "Operation" NOT "OK" NOT "1041" | rex "(?:.+message\"\:\")(?<Error_Message>.+)(?:\"\,)" | stats count by Error_Message

Deprasad · ‎06-09-2021

I would like to have my dashboard delivered in CSV format rater than PDF. Is it possible in Splunk? I have a total of 90 panels so can't rely on Reports. Please clarify

Deprasad · ‎01-08-2021

Thanks!! The payload you used in the regex101 is not same as the provided. Though it worked in Regex101, still faced the same issue with Splunk. Tried the solution suggested by @ITWhisperer and it worked.

Deprasad · ‎01-08-2021

Thanks!! that's worked. 🙂

Deprasad · ‎01-08-2021

Trying to Pick domainType and domainName from below log using the below regex: It works in regex101 but not in Splunk, it gives a blank column. domainName - rex"(?:domainName\\\"\:\\\")(?<domainName>([a-zA-Z0-9-\.]+))" domainType - rex"(?:domainType\\\"\:\\\")(?<domainType>\w)" "payload":"{\"domainType\":\"L\",\"modifiedBy\":\"\",\"relayHost\":\"\",\"rewriteDomain\":\"\",\"wildcardAccount\":\"\",\"domainName\":\"xxx.yyyyy.com\"}"},"encoding":null,"contentType":"application/json","responseCode":null}

Deprasad · ‎02-17-2020

strptime(Date, "%m/%d") gave a blank result for Date. Gone through Splunk documentation and found for epoch time conversion the command is strftime(x,y). Thanks for the help..!!

Deprasad · ‎02-17-2020

Thanks..! This is working, however the date field is in epoch format.

Deprasad · ‎02-17-2020

I have a query which extracts counts for last 30 days. But the dates are not in proper order in result. index = *** "search phrase" | stats count by date_mday | rename date_mday as Date If i make a search today for last 30 days, the result should be in the below order . 01/18, 19, 20 .......... 02/16,02/17.

Deprasad · ‎01-09-2020

Thanks @groktrev !! It worked with max_match command.

Deprasad · ‎01-09-2020

Thanks @to4kawa !! It worked with max_match command.

Posts	30
Solutions	2
Karma Given	6
Karma Received	3
Member Since	‎01-02-2020

Online Status	Offline
Date Last Visited	‎03-14-2024 02:49 AM

Splunk query to skip alphanumeric string

Drilldown - change in input not refreshing the con...

Joining two queries not giving the desired result

What cron expression should I use to set up alert?

Using Drilldown feature: How to define different q...

Query to get Percentage using two Queries?

Schedule CSV of Splunk Dashboard

Regex not working

How to extract the dates in order in a dashboard

How to pick multiple value which has same key name

Re: Splunk query to skip alphanumeric string

Re: Splunk query to skip alphanumeric string

Splunk query to skip alphanumeric string

Re: Drilldown - change in input not refreshing the...

Re: Drilldown - change in input not refreshing the...

Drilldown - change in input not refreshing the con...

Re: Joining two queries not giving the desired res...

Re: Joining two queries not giving the desired res...

Re: Joining two queries not giving the desired res...

Re: Joining two queries not giving the desired res...

Re: Joining two queries not giving the desired res...

Joining two queries not giving the desired result

What cron expression should I use to set up alert?

Using Drilldown feature: How to define different q...

Re: Query to get Percentage using two Queries.

Query to get Percentage using two Queries?

Schedule CSV of Splunk Dashboard

Re: Regex not working

Re: Regex not working

Regex not working

Re: How to extract the dates in order in a dashboa...

Re: How to extract the dates in order in a dashboa...

How to extract the dates in order in a dashboard

Re: How to pick multiple value which has same key ...

Re: How to pick multiple value which has same key ...