Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About labaningombam
labaningombam
Explorer
Member since:
07-27-2022
11-30-2023
Community Statistics
| Posts | 11 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 07-27-2022 |
Activity Feed
- Posted Re: Calculating math on three different searches on Getting Data In. 11-30-2023 01:45 AM
- Karma Re: Calculating math on three different searches for ITWhisperer. 11-30-2023 01:44 AM
- Posted Calculating math on three different searches on Getting Data In. 11-29-2023 10:24 PM
- Posted Re: Why are some values from events in splunk query returning NULL? on Splunk Search. 10-11-2022 01:16 PM
- Posted Why are some values from events in splunk query returning NULL? on Splunk Search. 10-11-2022 10:54 AM
- Posted Re: Need help in ignoring the ID of API endpoints on Splunk Search. 08-11-2022 05:43 AM
- Posted Re: Need help in ignoring the ID of API endpoints on Splunk Search. 08-11-2022 02:05 AM
- Posted Re: Need help in ignoring the ID of API endpoints on Splunk Search. 08-11-2022 02:04 AM
- Posted How do I extract only endpoints and ignore the ID of API endpoints? on Splunk Search. 08-10-2022 11:45 PM
- Posted How to extract string after particular word? on Splunk Search. 08-09-2022 12:16 AM
- Posted Re: Need help in extracting branch numbers from event message on Splunk Search. 08-01-2022 06:25 AM
- Posted Need help in extracting branch numbers from event message on Splunk Search. 08-01-2022 02:57 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-30-2023
01:45 AM
Thank you so much for the correction as well 🙂 This worked.
... View more
11-29-2023
10:24 PM
Hi, I need to write a query to find the time remaining to consume events. index=x message.message="Response sent" message.feedId="v1" | stats count as Produced index=y | spath RenderedMessage | search RenderedMessage="*/v1/xyz*StatusCode*2*"| stats count as Processed index=z message.feedId="v1" | stats avg("message.durationMs") as AverageResponseTime So I want to basically perform: Average Time left = Produced - Processed /AverageResponseTime How can I go about doing this? Thank you so much
... View more
Labels
- Labels:
-
data
-
field extraction
10-11-2022
01:16 PM
Here is an example of an actual event when I don't use Table on my query: index=myIndex "Properties.RequestPath"!="*/v1*/events/*" "Properties.RequestPath"!="*_status*" "Properties.StatusCode">399 "Properties.TraceId"!="" | dedup "Properties.TraceId" Event: Properties: { [-]
Path: /v1.0/locations/branches
QueryString: ?branchNumbers=5318&
RequestPath: /v1.0/locations/branches
StatusCode: 404
TraceId: 3f39adaf-ae24-44f4-b5cb-f8c49be023a0
} Attached is the screenshot of the result when I use table.
... View more
10-11-2022
10:54 AM
Hi,
I have the following event as an example.
Properties: { [-]
Path: /v1.0/locations/branches
QueryString: ?branchNumbers=5318&
RequestPath: /v1.0/locations/branches
StatusCode: 404
TraceId: 3f39adaf-ae24-44f4-b5cb-f8c49be023a0
}
I am trying to query this using the below search:
index=myIndex "Properties.RequestPath"!="*/v1*/events/*" "Properties.RequestPath"!="*_status*" "Properties.StatusCode">399 "Properties.TraceId"!="" | dedup "Properties.TraceId" | table "Properties.RequestPath" "Properties.TraceId "Properties.StatusCode" "Properties.QueryString"
The above query is returning the RequestPath and the TraceId just fine. But StatusCode and QueryString are all blank and when I check the tab, it says NULL.
Can anyone please help?
... View more
Labels
- Labels:
-
field extraction
-
lookup
08-11-2022
05:43 AM
Hi, I do have a field called RequestPath. Here are 3 different event logs. Properties: { [-]
Host:
MachineName:
RequestId:
RequestPath: /v1/locations/41b2ee1b-145es
StatusCode: 404
} Properties: { [-]
Host:
MachineName:
RequestId:
RequestPath: /v1/exceptions/ODD/123
StatusCode: 404
} Properties: { [-]
Host:
MachineName:
RequestId:
RequestPath: /v2/timebuckets/A4GH-A
StatusCode: 404
} My need is to have a count of how many errors are there for each request path without the ID(which is the last string in the endpoint after '/') So /v1/locations/ - 1 Failure /v1/exceptions/ODD/ - 1 Failure /v2/timebuckets/ - 1 Failure Something like this.
... View more
08-11-2022
02:05 AM
Actually, I have my request path in log as /v1/locations/45BH-JGN I need to extract "/v1/locations/" from it. Similarly I have endpoint /v1/exceptions/ABS/12 I need to extract only "/v1/exceptions/ABS/" So I need to ignore the last string which comes after "/" and get the same. @ITWhisperer
... View more
08-11-2022
02:04 AM
Actually, I have my request path in log as /v1/locations/45BH-JGN I need to extract "/v1/locations/" from it. Similarly I have endpoint /v1/exceptions/ABS/12 I need to extract only "/v1/exceptions/ABS/" So I need to ignore the last string which comes after "/" and get the same.
... View more
08-10-2022
11:45 PM
Hi,
I have a bunch of failure events of different api endpoints. The field is called RequestPath and some examples are:
/v1/locations/45BH-JGN
/v1/exceptions/ABS/12
/v1/exceptions/ODD/13
/v2/absence/100
Basically, I am trying to extract only the endpoints without the ids, so that I can get a count of which endpoints are failing, example
/v1/locations/ --- 1 failure
/v1/exceptions/ABS/ ----- 4 failures
/v1/exceptions/ODD/ ---- 10 failures , etc.
How can I do the same?
... View more
08-09-2022
12:16 AM
Hi,
I have a line in the event like
"/v1/locations/7b-cec6-4820-b699-ec"
I need to extract 7b-cec6-4820-b699-ec, or which ever comes after /v1/locations/ and before a "
Please help on the same.
Thank you.
... View more
08-01-2022
06:25 AM
Thank you so much, @richgalloway It works. Is there a way I can display only the branch after this command without showing count. I can display it with | stats count by branch
... View more
08-01-2022
02:57 AM
I have a field called RenderedMessage in event log which has the following text Task finished: TaskID 1 for branch 6000 I have been given the task to alert in an email all the branches that has the tasked finished. In my search, I am able to get the events for this task as index=prod | spath RenderedMessage | search RenderedMessage="*Task finished: ColleagueNextWeekTask*" How shall I extract only the branch values from this events/message? I need only the 6000 from this. Thank you.
... View more
Labels
- Labels:
-
field extraction
-
regex
-
rex
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-30-2023
03:54 AM
|
