Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Mick_OBrien
Mick_OBrien
Path Finder
Member since:
07-16-2021
03-20-2024
Community Statistics
| Posts | 36 |
| Solutions | 0 |
| Karma Given | 9 |
| Karma Received | 0 |
| Member Since | 07-16-2021 |
Activity Feed
- Posted Re: Syntax/use of subsearches on Splunk Search. 03-20-2024 08:58 AM
- Karma Re: Syntax/use of subsearches for ITWhisperer. 03-20-2024 08:58 AM
- Karma Re: Syntax/use of subsearches for ITWhisperer. 03-20-2024 08:58 AM
- Posted Re: Syntax/use of subsearches on Splunk Search. 03-20-2024 07:04 AM
- Posted Re: Syntax/use of subsearches on Splunk Search. 03-20-2024 04:01 AM
- Posted Re: Syntax/use of subsearches on Splunk Search. 03-20-2024 03:18 AM
- Posted Syntax/use of subsearches on Splunk Search. 03-20-2024 01:06 AM
- Karma Re: Identify a repeated set of messages [for looping process] for ITWhisperer. 09-24-2023 10:25 AM
- Posted Re: Identify a repeated set of messages [for looping process] on Splunk Search. 09-24-2023 10:24 AM
- Posted Re: Identify a repeated set of messages [for looping process] on Splunk Search. 09-24-2023 09:10 AM
- Posted Re: Identify a repeated set of messages [for looping process] on Splunk Search. 09-24-2023 09:05 AM
- Posted Re: Identify a repeated set of messages [for looping process] on Splunk Search. 09-22-2023 09:33 AM
- Posted Re: Identify a repeated set up messages [for looping process] on Splunk Search. 09-21-2023 12:55 AM
- Posted Re: Identify a repeated set up messages [for looping process] on Splunk Search. 09-21-2023 12:43 AM
- Posted How to Identify a repeated set up messages [for looping process]? on Splunk Search. 09-20-2023 11:42 PM
- Posted Re: Return message [logs] when the previous 'n' messages [logs] are identical on Splunk Search. 09-04-2023 07:48 AM
- Karma Re: Return message [logs] when the previous 'n' messages [logs] are identical for ITWhisperer. 09-04-2023 07:47 AM
- Posted Re: Return message [logs] when the previous 'n' messages [logs] are identical on Splunk Search. 09-04-2023 07:46 AM
- Posted Re: Return message [logs] when the previous 'n' messages [logs] are identical on Splunk Search. 09-02-2023 04:38 AM
- Posted Is it possible for a search string to pick up instances where the last [say] 3 logs are identical? on Splunk Search. 08-31-2023 12:14 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-20-2024
07:04 AM
@ITWhisperer
I ran...
| makeresults count=3
| streamstats count as a
| eval a=a+10, b=a+10, c=a+20
| format
...which gave...
( ( a="11" AND b="21" AND c="31" ) OR ( a="12" AND b="22" AND c="32" ) OR ( a="13" AND b="23" AND c="33" ) )
...which tallies with fields/rows as 'AND'/'OR' but if don't understand output from your original example...
| makeresults count=3
| streamstats count as a
| eval a=a+10, b=a+10, c=a+20
| format 1 2 3 4 5 6
1 2 a="11" 3 b="21" 3 c="31" 4 5 2 a="12" 3 b="22" 3 c="32" 4 5 2 a="13" 3 b="23" 3 c="33" 4 6
??
... View more
03-20-2024
04:01 AM
@ITWhisperer With 'format' at the end worked - thank you very much Just checked documentation which indicates [to me] that returned string have input search results separated by 'OR' command - do I understand correctly? format - Splunk Documentation This command is used implicitly by subsearches. This command takes the results of a subsearch, formats the results into a single result and places that result into a new field called search. The format command performs similar functions as the return command. . . . mvsepSyntax: mvsep="<string>"Description: The separator to use for multivalue fields.Default: ORmvsepSyntax: mvsep="<string>"Description: The separator to use for multivalue fields.Default: OR
... View more
03-20-2024
03:18 AM
@ITWhisperer Changed to match format as detailed... index=blah [search index=blah "BAD_REQUEST" | rex "(?i) requestId (?P<search>[^:]+)" | table search | dedup search] ...but new format ONLY returned rows containing 92d246dd-7aac-41f7-a398-27586062e4fa [first row] and no other rows. I removed 'dedup' but that did not help How can I include all returned items from inner search as input to outer [main] search?
... View more
03-20-2024
01:06 AM
I have a query … index=blah "BAD_REQUEST" | rex "(?i) requestId (?P<requestId>[^:]+)" | table requestId | dedup requestId …that returns 7 records/fields… 92d246dd-7aac-41f7-a398-27586062e4fa ba79c6f5-5452-4211-9b89-59d577adbc50 711b9bb4-b9f1-4a2b-ba56-f2b3a9cdf87c e227202a-0b0a-4cdf-9b11-3080b0ce280f 6099d5a3-61fc-418b-87b4-ddc57c482dd6 348fb576-0c36-4de9-a55a-97157b00a304 c34b7b96-094d-45bb-b03d-f9c98a4efd5f …that I then want to use as input for another search on the same index I looked at manual and can see that subsearches are allowed [About subsearches - Splunk Documentation] but when I add my subsearch as input … index=blah [search index=blah "BAD_REQUEST" | rex "(?i) requestId (?P<requestId>[^:]+)" | table requestId | dedup requestId] ..I would have expected at least 7 records to have been returned BUT I do not see any output. There are no syntax issues so can someone explain to me what I’m not seeing/doing? Any help appreciated.
... View more
Labels
- Labels:
-
subsearch
09-24-2023
10:24 AM
Thanks - the pre-9 syntax works but multiple instances of the same repeated log are displayed.... Is there a way to limit to one set of logs?
... View more
09-24-2023
09:10 AM
See below - no output from search string...
... View more
09-24-2023
09:05 AM
Splunk Enterprise Version:8.2.7.1
... View more
09-22-2023
09:33 AM
I ran from search prompt bar but nothing was returned for result set - is there a specific way to use 'makeresults' syntax?
... View more
09-21-2023
12:55 AM
Sorry - but how does this pick up a set of messages on the same process repeating?
... View more
09-21-2023
12:43 AM
The messages are valid but once starting to loop indicates issue with process - messages can be from different processes but I am only interested in messages repeating on same process.
... View more
09-20-2023
11:42 PM
We have a job that occasionally loops around the same code spewing out same set of messages [2 different messages from same job] - is it possible to identify processes where the last 2 messages match the previous 2 messages...
.
.
.
message1
message2
message1 <-- starts repeating/looping here
message2
message1
message2
message1
message2
.
.
Any help appreciated.
Mick
... View more
- Tags:
- splunk search
09-04-2023
07:48 AM
Issue was 'sort' limited to 10,000 rows so replacing with 'sort 0' and I see what I need to see [no missing jobs]
... View more
09-04-2023
07:46 AM
Hi All Issue finally resolved. This is what I was told - 'sort' command limit is 10,000 and issue was the rather large number of log being returned and the resolution was to replace 'sort' with 'sort 0' which returns all logs [and now I see everything I need to]
... View more
09-02-2023
04:38 AM
My index has logs for multiple Robot jobs so I added a search before the suggested string.... index=ee_rpa_uipath_platform_* AND OrganizationUnitID IN ($folder$) | sort OrganizationUnitID, RobotName, _time, Message | streamstats count reset_on_change=true by Message | where count > 2 | table OrganizationUnitID, User, RobotName, ProcessName, MachineName, _time, Message | sort -_time ...but now what I am finding is that ONLY one Robot has its logs being displayed once search complete i.e. whilst search is ongoing other logs for other Robots are displayed in panel but then disappear once search finishes. Any ideas on why these logs for other Robots are removed from search? I put the suggested search string in my searh
... View more
08-31-2023
12:14 AM
Hi All
We have a couple of jobs that occasionally loop around same code returning same message/log - is it possible for a search string to pick up instances where the last [say] 3 logs are identical?
Kinds regards
Mick
... View more
02-28-2023
12:00 AM
Sorry - I don't know what you mean by SPL and SPL2? Is there another way of enriching output results using loopup?
... View more
02-27-2023
07:13 AM
From... lookup command examples - Splunk Documentation ..I see this example... ... | lookup users uid OUTPUTNEW username, department What I was trying to do was include a temporary dataset... Datasets - Splunk Documentation i.e. trying to use same sample data as example then something along the lines of... ... | lookup [ {uid: "1066", username: "Claudia Gasrcia", department: "Engineering" }, {...}, {...} ] uid OUTPUTNEW username, department ...or generally... search ... | lookup [temporary_dataset] key OUTPUTNEW <lookup_table_fields> Is this use of lookup and temporary datasets possible?
... View more
02-27-2023
03:43 AM
I'm trying to add a lookup to enrich results returned from a 'simple' search. The search command I'm using [and I have limited to one key/value pair] is: -
index=ee_commercialbankingeforms_pcf "*LEVEL=WARN*" | rex "^\S+\s(?<microService>\S+).*MESSAGE=(?<message>.+)" | bucket _time span=day | stats count by microService, message | lookup [ {JIRASummary: "No JWT found on UserPrincipal and no custom JWT claims configured. No nested JWT will be sent in downstream requests!", JIRA: "CBE-968"} ] JIRASummary AS message OUTPUT JIRA
...but I keep seeing following error...
Error in 'SearchParser': Missing a search command before '{'. Error at position '192' of search query 'search index=ee_commercialbankingeforms_pcf "*LEVE...{snipped} {errorcontext = lookup [ {JIRASummar}'.
Can someone explain the error that I see?
Regards
Mick
... View more
09-07-2022
01:30 AM
Hi @gcusello Thanks for reply but I want to extract the url after the GET Mick
... View more
09-07-2022
12:49 AM
I have logs of the format...
2022-09-07T01:42:06.321624+00:00 micro.service 2867ce23-bdfd-48eb-ba5a-40e1e8a93987[[APP/PROC/WEB/0]] 159.203.190.66, 100.64.144.3 - - - [07/Sep/2022:01:42:06 +0000] "GET url HTTP/1.1" 404 125
...and I want to extract a count of missing URLs by microservice. I can get a count of microservice using...
index=myIndex "404 125" | rex "^\S+\s(?<microService>\S+).*" | bucket _time span=day | stats count by microService
...but I would like to know how to add the url
Any help appreciated
... View more
Labels
- Labels:
-
field extraction
-
rex
08-16-2022
01:28 AM
Hi @gcusello Sorry but I cannot get this to work - this rex string returned multiple pages of empty fields... rex field=_raw ^\d+-\d+-\d+T\d+:\d+:\d+\.\d+\+\d+:\d+\s+(?<microservice>\w+).*MESSAGE\=(?<message>.+) its not picking up the microservice NOR does the test string supplied contain text 'MESSAGE='
... View more
08-16-2022
01:10 AM
Hi @gcusello As requested. Used this URL/tool... https://regex101.com/r/nE14zp/1 ...to check these REX strings... ^\S+\s(?<microService>\S+).* (?i)^(?:[^\+]*\+){2}\d+\]\s+\"(?P<missingFileDetails>[^\"]+) ...using this test string... 2022-08-16T04:00:13.231444+00:00 CBF.microService af312b94-8abc-49ed-af80-969a5b0044e4[[APP/PROC/WEB/2]] 139.59.241.107, 100.64.240.3 - - - [16/Aug/2022:04:00:13 +0000] "GET /git/notifyCommit?url=2DQDJjcLvzZRdjs6bf9k0KOtJCs&branches=2DQDJjcLvzZRdjs6bf9k0KOtJCs HTTP/1.1" 404 188 The individual commands work but I am unable to concatenate [to get a table of microservices and missing files]. Any help greatly appreciated
... View more
08-16-2022
12:45 AM
I have two REX strings that work independently...
^\S+\s(?<microService>\S+).*
[supplied by previous SPLUNK answer]
...and...
"(?i)^(?:[^\+]*\+){2}\d+\]\s+\"(?P<missingFileDetails>[^\"]+)"
[generated via erex]
How can these two REX commands be merged?
... View more
Labels
- Labels:
-
field extraction
-
rex
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-20-2024
02:40 AM
|
