Hello Splunkers, I need help with below scenario: I need to form query from xml log in below format. TransactionID            LineNumber            Fulfiller 123                                        1                             abc 124                                         1                            xyz 125                                         1                            def                                                   2                           xyz 126                                          1                           abc                                                    2                           def                                                    3                            xyz So, here in my xml logs sometime i am having only one LineNumber mentioned and correspondingly fulfiller. However, in some log events i am having multiple LineNumbers with corresponding fulfillers for same transactionid. I have used regex to extract transactionid, LineNumber and fullfiller name. I want result in above format. Hope I am able to explain my scenario.   ... View more

Hi All. I need help with Splunk Query for below scenario: I need to show the status of my cronjob in below format. Starttime FinishTIme CurrentStatus Time when Job Starts Time when Job Finishes Started/Running/Finished   Start:- INFO | jvm 1 | main | 2020/07/16 03:30:08.407 xxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Found 13 set of files to process End:- INFO | jvm 1 | main | 2020/07/16 04:21:57.914 xxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Ended . RESULT :true In between there are many lines for which status should be running.. Thanks in dvance ... View more

The below is my query to extact fields from screenshot attached. index=***** host=***** source=****** | rex field=_raw max_match=0 "(?[a-z]+),(?\w+\-?\d?.*)\,(?\d?.*)" Now I want to convert Size field from string to numeric as have to perform various statistical operations. I used tonumber, convert, fieldformat but none worked. This is my final query index=**** host=***** source=******** | rex field=_raw max_match=0 "(?[a-z]+),(?\w+\-?\d?.*)\,(?\d?.*)" | table Brand,Size,Files | eval _counter = mvrange(0,mvcount(Brand)) | stats list(*) as * by _counter | foreach * [ eval <> = mvindex('<>' , _counter)] | xyseries Brand Files Size | transpose 0 header_field=Brand column_name=Files | foreach * [ eval <> = if(isnull(<>) OR len(<>)==0, "0", <>) ] I have to convert Size values from kb into mb for this I need to change them from string to number. ... View more

I have data in below format in Splunk where I extracted this as Brand,Files,Size. Now at some places, where size is showing empty, I want to replace them with 0. I have used | fillnull value 0. | eval Size=if(isnull(Size), "0", Size) But still values are showing empty. I have used below query index=*** host=*** source=**** | rex field=_raw max_match=0 "(?[a-z]+),(?\w+\-?\d?.*)\,(?\d?.*)" | table Brand,Size,Files | eval _counter = mvrange(0,mvcount(Brand)) | stats list(*) as * by _counter | foreach * [ eval <> = mvindex('<>' , _counter)] | xyseries Brand Files Size | transpose 0 header_field=Brand column_name=Files | fillnull value=0 and the result i m getting as like below After using | fillnull value 0, I am getting 0 for those files which are not there for 2nd,3rd,4th brands. But not where size is showing empty. Can anyone help me with this ? ... View more

How to trigger an alert if http _status code =200 is not reported in logs for any host from last 15 mins ? ... View more