@pdpsplunk100 @sundareshr @ppablo Is there any update for achieving the same in splunk 9.0.5.1 version? ... View more

@gcusello  Thanks! Seems some visualization issue. Tried to read 10,000 or 10,240 characters but no luck. Btw, what do you mean by changing the chars dimension? Any other comments would be appreciated. ... View more

This helps. Thank you for the solution! ... View more

@richgalloway  Thanks for your reply. I tried something like below, but what I realized is stats command is only propagating only LocationId and flag fields and hiding the time. Hence not able to make time comparison. If I check matches_time, metrics_time fields after stats command, those are blank. | savedsearch "savedsearch1" | eval flag="match" | rename _time as matches_time | append maxtime=1800 timeout=1800 [ savedsearch "savedsearch2" | eval flag="metric" | rename _time as metrics_time] | stats values(flag) as flag by LocationId | where (flag="metric" and flag!="match") or (flag="metric" and flag="match" and metrics_time<matches_time) | table LocationId  Is there any other way to achieve this. May be a different one rather than append mechanism. ... View more

@richgalloway Thanks for your response. I don't want to get min of time out of those two locationIds. The moment I see LocationId in both the reports, I want to ensure that savedsearch1._time > savedsearch2._time. In a simple coding language it could be..... ################################################ var LocationIdList; //add if it is present in savedsearch2 but not in savedsearch1 if(savedsearch2.contains(LocationId) && !savedsearch1.contains(LocationId)){ LocationIdList.add(LocationId); } //if it is present in both if (savedsearch2.contains(LocationId) && savedsearch1.contains(LocationId)){ //add only when savedsearch1 occurs later than savedsearch2 if (savedsearch1._time>savedsearch2._time){ LocationIdList.add(LocationId); } } ################################################ ... View more

Great approach to filter the required data. Appreciate your help. Btw, I was the developer who is new to splunk😄 ... View more

@ITWhisperer  and @FrankVl  I am trying to expand couple of fields (locationId, matchRank) using the method suggested above. But it only expands last entry in the list and results doesn't contain all the entries from both the lists. My matched_locations json array can have atmost 10 items in it with the presence of both locationId and matchRank Below is the query which I am trying out... ############################################################# index=app_pcf AND cf_app_name="myApp" AND message_type=OUT AND msg.logger=c.m.c.d.MatchesApiDelegateImpl | search "msg.logMessage.numReturnedMatches">0 | spath | fillnull value="0" | eval steps=max(mvcount('msg.logMessage.matched_locations{}.locationId'),mvcount('msg.logMessage.matched_locations{}.matchRank')) | streamstats sum(steps) as toprow | eval maxrow=toprow | append [| makeresults | eval toprow=1 | fields - _time] | eventstats min(maxrow) as firsttop | where isnotnull(maxrow) or toprow != firsttop | makecontinuous toprow | reverse | filldown | reverse | eval locationId=mvindex('msg.logMessage.matched_locations{}.locationId',(steps - 1) - (maxrow - toprow)) | eval rank=mvindex('msg.logMessage.matched_locations{}.matchRank',(steps - 1) - (maxrow - toprow)) | fields - maxrow toprow firsttop steps | foreach * [ eval <<FIELD>>=if('<<FIELD>>'="0",null,'<<FIELD>>')] | table locationId,rank ############################################################# I am getting locationId,rank from last entry of every event in the list. Below is the sample splunk data ########################################################### cf_app_name: myApp cf_org_name: myOrg cf_space_name: mySpace job: diego_cell message_type: OUT msg: { application: myApp correlationid: 0.af277368.1669261134.5eb2322 httpmethod: GET level: INFO logMessage: { apiName: Matches apiStatus: Success clientId: oh_HSuoA6jKe0b75gjOIL32gtt1NsygFiutBdALv5b45fe4b error: NA matched_locations: [ { city: PHOENIX countryCode: USA locationId: bef26c03-dc5d-4f16-a3ff-957beea80482 matchRank: 1 merchantName: BIG D FLOORCOVERING SUPPLIES postalCode: 85009-1716 state: AZ streetAddress: 2802 W VIRGINIA AVE } { city: PHOENIX countryCode: USA locationId: ec9b385d-6283-46f4-8c9e-dbbe41e48fcc matchRank: 2 merchantName: BIG D FLOOR COVERING 4 postalCode: 85009 state: AZ streetAddress: 4110 W WASHINGTON ST STE 100 } { [+] } { [+] } { [+] } { [+] } { [+] } { [+] } { [+] } { [+] } ] numReturnedMatches: 10 } logger: c.m.c.d.MatchesApiDelegateImpl } origin: rep source_instance: 1 source_type: APP/PROC/WEB timestamp: 1669261139716063000 } ########################################################### ... View more

@FrankVl  Looks like it is serving my purpose. Thanks a lot. ... View more

Great Post @ITWhisperer  I have a scenario where i want to expand the field and show as individual events. Below is my query, which works fine for smaller intervals of time, but larger intervals its not efficient. index=app_pcf AND cf_app_name="myApp" AND message_type=OUT AND msg.logger=c.m.c.d.MatchesApiDelegateImpl | spath "msg.logMessage.matched_locations{}.locationId" | search "msg.logMessage.numReturnedMatches">0 | mvexpand "msg.logMessage.matched_locations{}.locationId" | fields "msg.logMessage.matched_locations{}.locationId" | rename "msg.logMessage.matched_locations{}.locationId" to LocationId | table LocationId I have a json array called matched_locations which has field locationId. I can have atmost 10 locationIds in a matched_locations I have thousands of events in the duration which will have this matched_locations json array. Below is example of one such event with bunch of matched_locations ########################################################### cf_app_name: myApp cf_org_name: myOrg cf_space_name: mySpace job: diego_cell message_type: OUT msg: { application: myApp correlationid: 0.af277368.1669261134.5eb2322 httpmethod: GET level: INFO logMessage: { apiName: Matches apiStatus: Success clientId: oh_HSuoA6jKe0b75gjOIL32gtt1NsygFiutBdALv5b45fe4b error: NA matched_locations: [ { city: PHOENIX countryCode: USA locationId: bef26c03-dc5d-4f16-a3ff-957beea80482 matchRank: 1 merchantName: BIG D FLOORCOVERING SUPPLIES postalCode: 85009-1716 state: AZ streetAddress: 2802 W VIRGINIA AVE } { city: PHOENIX countryCode: USA locationId: ec9b385d-6283-46f4-8c9e-dbbe41e48fcc matchRank: 2 merchantName: BIG D FLOOR COVERING 4 postalCode: 85009 state: AZ streetAddress: 4110 W WASHINGTON ST STE 100 } { [+] } { [+] } { [+] } { [+] } { [+] } { [+] } { [+] } { [+] } ] numReturnedMatches: 10 } logger: c.m.c.d.MatchesApiDelegateImpl } origin: rep source_instance: 1 source_type: APP/PROC/WEB timestamp: 1669261139716063000 } ########################################################### Can you help me with how I can expand this field efficiently? Thank you. ... View more