Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ravimishrabglr
ravimishrabglr
Loves-to-Learn Lots
Member since:
12-10-2019
12-29-2022
Community Statistics
| Posts | 12 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 12-10-2019 |
Activity Feed
- Posted How to group first 5 line of similar stack trace across request? on Knowledge Management. 12-18-2022 06:45 AM
- Posted Splunk query not producing expected result on Splunk Enterprise. 10-25-2021 04:56 AM
- Posted Re: Summary Index sistats not working with xyseries on Knowledge Management. 03-20-2020 04:34 AM
- Posted Re: Summary Index sistats not working with xyseries on Knowledge Management. 03-19-2020 10:39 PM
- Posted Re: Summary Index sistats not working with xyseries on Knowledge Management. 03-19-2020 10:19 AM
- Posted Re: Summary Index sistats not working with xyseries on Knowledge Management. 03-06-2020 12:30 AM
- Posted Re: Why are my posts awaiting moderation? on #Random. 03-04-2020 03:01 AM
- Posted Summary Index sistats not working with xyseries on Knowledge Management. 03-03-2020 11:54 PM
- Tagged Summary Index sistats not working with xyseries on Knowledge Management. 03-03-2020 11:54 PM
- Tagged Summary Index sistats not working with xyseries on Knowledge Management. 03-03-2020 11:54 PM
- Tagged Summary Index sistats not working with xyseries on Knowledge Management. 03-03-2020 11:54 PM
- Tagged Summary Index sistats not working with xyseries on Knowledge Management. 03-03-2020 11:54 PM
- Tagged Summary Index sistats not working with xyseries on Knowledge Management. 03-03-2020 11:54 PM
- Posted Re: How to extract API name from below URL field in Splunk, on Splunk Search. 12-12-2019 02:18 AM
- Posted Re: How to extract API name from below URL field in Splunk, on Splunk Search. 12-11-2019 10:11 PM
- Posted Re: How to extract API name from below URL field in Splunk, on Splunk Search. 12-11-2019 10:08 PM
- Posted How to extract API name from below URL field in Splunk, on Splunk Search. 12-10-2019 10:37 PM
- Tagged How to extract API name from below URL field in Splunk, on Splunk Search. 12-10-2019 10:37 PM
- Tagged How to extract API name from below URL field in Splunk, on Splunk Search. 12-10-2019 10:37 PM
- Tagged How to extract API name from below URL field in Splunk, on Splunk Search. 12-10-2019 10:37 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-18-2022
06:45 AM
I need a query to group similar stack trace across request (CR- Correlation Id) in a specific format:
Query:
index="myIndex" source="/mySource" "*exception*" | rex field=_raw "(?P<firstFewLinesOfStackTrace>(.*\n){1,5})" | eval date=strftime(_time, "%d-%m-%Y") | head 3 | reverse | table date, CR, count, firstFewLinesOfStackTrace
Format:
Date
CR
Count
Log
01/12/22
CR_1 CR-2
2
StackTrace1 StackTrace2 StackTrace3
02/12/22
CR_1 CR-2 CR-3
3
DiffStackTrace1 DiffStackTrace2 DiffStackTrace3
Am not sure how to group these logs as each stack trace have _date as unique identifier, also how to get the result in above format (what to use stats, eventstats, table, etc.) pls help, thanks in advance.
... View more
Labels
- Labels:
-
event type
-
lookup
-
other
10-25-2021
04:56 AM
Below query is producing expected result only sometime, but not working for similar data on some other random days. Query: index=my_summary source=app_response_status report=app_response_status ApiName=metadata | timechart span=1d sum("200"), sum("404") Working Data: 10/24/2021 00:00:00 +0000, search_name=app_response_status, search_now=1635123600.000, info_min_time=1635033600.000, info_max_time=1635120000.000, info_search_time=1635124485.280, 200=7552, 404=7582, ApiName=metadata, info_sid=scheduler__gmrm_VkEtdm1lLXJ0bXMtc2g__RMD50cd89fe00e4c64f8_at_1635123600_39072, RowTotals=15134, info_max_time="1635120000.000", info_min_time="1635033600.000", info_search_time="1635124485.280", report=app_response_status Not Working Data: 09/03/2021 00:00:00 +0000, search_name=app_response_status, search_now=1630717200.000, info_min_time=1630627200.000, info_max_time=1630713600.000, info_search_time=1630717575.202, 200=9483, 404=5287, ApiName=metadata, info_sid=scheduler__gmrm_VkEtdm1lLXJ0bXMtc2g__RMD50cd89fe00e4c64f8_at_1630717200_72746, RowTotals=14770, info_max_time="1630713600.000", info_min_time="1630627200.000", info_search_time="1630717575.202", report=app_response_status I am not able to figure out the problem, both data looks same to me, but not sure why it is not working. pls help.
... View more
Labels
03-20-2020
04:34 AM
In above, i provided count (10, 20) just for example, but below are real the count from old query and the new query that you provided.
ApiName | oldQuery | newQuery
abc | 8258875 | 21781751
xyz | 74371 | 2283504
... View more
03-19-2020
10:39 PM
@ololdach Thanks for the answer, but i know that. my problem was when i was using sistats in above query, it was producing no data to push into summary index, but it should produce data with additional info columns prefixed with psrsvd, when you run query with sistats it gives output and that output is kept in summary index so that we can query later.
... View more
03-19-2020
10:19 AM
Thanks @to4kawa It worked but I ran into another strange problem, here is my query-
index="myIndex" host="myHost" source="/var/logs/events.log" sourcetype="ss:vv:events" (MTHD="POST" OR MTHD="GET")
| rex field=U "(?P[^\/]+)(\/([a-zA-Z0-9]{32})|$)"
| where ApiName IN ("abc", "xyz")
| dedup CR,RE
| stats count as TotalReq by ApiName, Status
| xyseries ApiName Status, TotalReq
Now when I am using IN command in above query like this:
| where ApiName IN ("abc") produce 10 events and
| where ApiName IN ("xyz") produce 20 events but when using both ApiName together
| where ApiName IN ("abc", "xyz") produce 25 events only, it should produce 30 right? where are 5 events?
Please help me how to fix this problem. Plus CCing wonderful people who already helped me in other question: @richgalloway @gf13579 @vnravikumar
... View more
03-06-2020
12:30 AM
@to4kawa 1st worked, able to push data in summary index. but while fetching it is not aggregating result. it is returning 2 time same api name and counts in 2 days search. running collect query daily in a scheduled report.
... View more
03-04-2020
03:01 AM
@ppablo_splunk Hi, this is my second question posted, first one went through but this one is put on moderation, can you please help me as well-
https://answers.splunk.com/answers/807292/summary-index-sistats-not-working-with-xyseries.html
... View more
03-03-2020
11:54 PM
I have Two Questions:
1st Questions: Below is the query to generate stats that I want to push into Summary Index:
index="myIndex" host="myHost" source="/var/logs/events.log" sourcetype="ss:vv:events" (MTHD="POST" OR MTHD="GET") | rex field=U "(?P[^\/]+)(\/([a-z0-9]{32})|$)" | search (ApiName=abc OR ApiName=xyz) | dedup CR,RE | stats count as TotalReq by ApiName, Status | xyseries ApiName Status, TotalReq | addtotals labelfield=ApiName col=t label="ColTotals" fieldname="RowTotals"
It gives me perfect result as:
ApiName | 200 | 400 | 404 | 500 | RowTotals abc | 12 | 2 | 4 | 1 | 19 xyz | 10 | 3 | 2 | 2 | 17 ColTotals | 22 | 5 | 6 | 3 | 36
But when I am changing stats to sistats to push into Summary Index, it is not producing any result, please help me with the query.
2nd Question: I already have a Summary Index available and one stats report with different query is already been pushed everyday, which I have annotated using Add Fields option in Edit Summary Index window as report = firstReport, now can I push another (above) report into same Summary Index with different annotation as report = secondReport? will it work or I have to create another Summary Index for this report also, Please help.
... View more
Labels
- Labels:
-
summary indexing
12-12-2019
02:18 AM
Thank you @gf13579 it worked!!! I will Accept the answer.
... View more
12-11-2019
10:11 PM
@gf13579 Thanks for the answer! I feel it is very close, could you please have a look in my comment in the question for more detail.
... View more
12-11-2019
10:08 PM
@richgalloway I want last part of the url, if it has 32 digit id in the last then ignore it and get second last part.
I tried regex as per @gf13579 in my below query but it is returning getContent ONLY. please help me if my query is right. U is the field here and i am trying to create a board to show latency of all APIs.
index="myIndex" host="myApp" source="mySource" sourcetype="mySourceType" (MTHD="POST" OR MTHD="GET") | rex field=U "\/(?[^\/]+)(\/([a-z0-9]{32})|\"$)" |
dedup CR,RE | stats count as TotalReq, min(D) as Min, max(D) as Max, avg(D) as Avg, perc95(D) as P95, perc98(D) as P98, perc99(D) as P99 by ApiName, MTHD | addinfo |
eval range = info_max_time - info_min_time | eval TPS=round(TotalReq/range,2) | eval Avg=round(Avg,2) |
fields ApiName, MTHD, TotalReq, TPS, Min, Max, Avg, P95, P98, P99
... View more
12-10-2019
10:37 PM
U="/my-web/services/v1/2/cartMetadata"
U="/my-web/services/v1/2/cartMetadata/delivery"
U="/my-web/services/v1/cps/getContent/8efa90da34cb4046ae0c65b2935ff5bc"
Trying using : ^(?:[^/\n]*/){5}(?P\w+) but getting result as-
cartMetadata
getContent
But I want this-
cartMetadata
delivery
getContent
Please help.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-29-2022
02:34 PM
|
