Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About maramk
maramk
Explorer
Member since:
10-04-2021
11-05-2021
Community Statistics
| Posts | 14 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 10-04-2021 |
Activity Feed
- Posted Re: Compare two query results and run third query on Splunk Search. 11-05-2021 07:15 AM
- Posted Re: Compare two query results and run third query on Splunk Search. 11-04-2021 07:07 PM
- Posted Re: Compare two query results and run third query on Splunk Search. 11-04-2021 01:53 PM
- Posted Re: Compare two query results and run third query on Splunk Search. 11-04-2021 12:47 PM
- Posted Re: Compare two query results and run third query on Splunk Search. 11-04-2021 12:36 PM
- Posted Re: Compare two query results and run third query on Splunk Search. 11-04-2021 11:55 AM
- Posted Compare two query results and run third query on Splunk Search. 11-04-2021 11:20 AM
- Posted Re: How to extract a URL between two strings ? on Splunk Search. 11-03-2021 01:36 PM
- Karma Re: How to extract a URL between two strings ? for somesoni2. 11-03-2021 01:36 PM
- Posted How to extract a URL between two strings ? on Splunk Search. 11-03-2021 12:37 PM
- Posted Re: How to get rid of extra space from the output of a splunk query on Splunk Search. 10-05-2021 03:52 PM
- Posted Re: How to get rid of extra space from the output of a splunk query on Splunk Search. 10-05-2021 02:38 PM
- Posted Re: How to get rid of extra space from the output of a splunk query on Splunk Search. 10-05-2021 02:35 PM
- Tagged How to get rid of extra space from the output of a splunk query on Splunk Search. 10-05-2021 08:21 AM
- Posted How to get rid of extra space from the output of a splunk query on Splunk Search. 10-04-2021 06:30 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
11-05-2021
07:15 AM
@yuanliu , Can you please suggest separate rex commands to extract x1 and x2 values individually from the field 'text' in the same event? Thanks.
... View more
11-04-2021
07:07 PM
hi @yuanliu , I tried this command as you suggsted, but its not returning any values for x1 and x2. As per your command, you posted some data to splunk and retrieving it "_raw" data. But for me, the query is looking to extract the values from event data. May be thats the reason that command is not working for me.
... View more
11-04-2021
01:53 PM
Hi @yuanliu , I tried to run the 3rd command as you suggested. But the splunk not returning any values for x1 and x2. Both the values are returning as null. can you please check if some error in the query based on the logs i provided? Thanks.
... View more
11-04-2021
12:47 PM
Just FYI, Both the log blocks are from the same event. Also, in the command you suggested, where do the splunk query is comparing the values of x (value1 and value2).
... View more
11-04-2021
11:55 AM
@richgalloway Thanks for replying to my question. The reason i need to run third query is to extract project_id is only when the x values (value1, value2) matches from two log blocks. Both values should be same to extract the project_id
... View more
11-04-2021
11:20 AM
Hi, I have a log file looks like below. In first block of logs i need to extract x value1 and in second block of logs i need to extract the x value2. If both the values matches i need to run another query to get the output of proj_id. Logs: Code=Info words=check text=Checking for messages... received \x1B[0;m job\x1B[0;x=value1 proj_id=edcbidh Code=Info words=check text=\x1B[0;33mwarning: failed \x1B[0;m \x1B[0;33mduration\x1B[0;m=00.0006ms \x1B[0;33mjob\x1B[0;x=value2 \x1B[0; Any help is appreciated. Thanks.
... View more
11-03-2021
12:37 PM
Hi, I am a have content like below and i would like to extract git url from it. Please suggest me how to do it using rex? Content: proj_url\x1B[0;m=https://my.test.net/sample/test.git test\x1B[0;m=abcd. Output should be: https://my.test.net/sample/test.git Any help is appreciated. Thanks.
... View more
Labels
- Labels:
-
regex
10-05-2021
03:52 PM
@danielcj and @Azeemering , adding "where isnotnull(json)" at the end of the query fixed the issue. Thanks.
... View more
10-05-2021
02:38 PM
Hi @Azeemering , I tried it as you suggested well. Check the command i run below for my query. Please suggest me if i can make it better to get the file name without empty lines before and after. filename | rex "uploaded to: s3:someurl/(?<json>.*)" | rex field=json mode=sed "s/(^\s+)|(\s+$)//g" | table json output still showing as, ................................ .............................. ............................. file.txt .............................. .............................. ............................ I have to get rid of those extra lines and display just the file name. I appreciate your help Thanks. Thanks.
... View more
10-05-2021
02:35 PM
hi @danielcj , Thanks for the response. The above command you suggested doesn't remove extra lines. Its returning the same result before and after. I am running the query to match a file name from the splunk logs and extracting it to display. But there are empty lines before and after the file name as below. output: ............................ ........................... .......................... file.txt ......................... ..................... .................. can you suggest me anything better. Appreciate your response. Thanks. Thanks.
... View more
10-04-2021
06:30 PM
Hi Guys, I have a splunk command which returns a filename as the output. But i found that there is an extra space before and after the filename. query i am running here is, filetest | rex "sent to: https://someurl/(?<file>.*)" | table file Output displayed as: ............................... .............................. ............................. .............................. file.txt ............................. ........................... ............................ how can i get rid of the extra space before and after the file name? Thanks.
... View more
- Tags:
- trim
Labels
- Labels:
-
table
