"How are these transactions linked together... by a field called "ID"? If so.. just build them with the field ID, and then use one of the MV commands to extract a field with success or failure in it. Paste some samples and…"
The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Nikita posted a discussionCount failures and success via transaction
Hi,I'm a new in Splunk so sorry for the stupid questions.I want to calculate failures in logs.For example we have request log and response log."request" OR ("fail" OR "response") |transaction startsWith=("request") endsWith=("fail" OR "response") maxpause=5s keepevicted=false maxspan=25s id |eval Failure=if(searchmatch("fail"),1,0)| eval Success=if(searchmatch("response"),1,0) | stats count(Failure) as FailureCount, count(Success) as SuccessCount | table FailureCount SuccessCountThat query…See More
Splunk equivalent of the *nix 'cut -d' ' -f1-5
Hello,
I just started playing with splunk. I looked thru the docs and unable to find any commands that allow me to do the *nix equivalent of 'cut -d' ' -f1,5'
Any comments appreciated
Thanks
Harish
I just started playing with splunk. I looked thru the docs and unable to find any commands that allow me to do the *nix equivalent of 'cut -d' ' -f1,5'
Any comments appreciated
Thanks
Harish
Views: 47
Replies to This Discussion
-
Permalink Reply by Michael Wilde on -
Harish..
Are you attempting to do field extraction---a well written regex should be able to reproduce what you want... Got a sample? Post it and we'll see if we can figure it out.
-
Permalink Reply by harish on -
Micheal
I search for "SiteWS" and get the below event
"Timestamp: 11/12/2009 2:09:41 PM Title: (SiteWS) Message: [@SiteIdService getWebServiceResult()] [SessionID: 5wrjjxk0osv33k] [TheNewCustomer: CustomerId=51234567888&OrderId=bf8130a6-d916-4fd4-b2d2-c48624&AccountFlag=True&UserName=test] [Ticks: 128201781] [Took: 0 milliseconds] Called Write() on the request stream to [SiteUrl: http://test.com/v2/services/calculate]"
Now, I need to get the "Took: 0 milliseconds" and the "http://test.com/v2/services/calculate"
Thanks
Harish
-
Permalink Reply by Michael Wilde on
-
You may want to give the "Extract Fields" option on the event menu (right next to each event's timestamp. It will build a regex for you and persist it--so its always extracted...
However, if you're event structure is basically the same for every event. This should work (at search time). Let me know and i will show you how to persist it
SiteUrl | rex "\[\S+(?[^\]]*)\] \[\S+(?[^\]]*)\] \[\S+(?[^\]]*)\] \[\S+(?[^\]]*)\] \[\S+(?[^\]]*)\s\w+\][^\[]*\[\S+(?[^\]]*)\]"
In a nutshell, rex is a search command that lets you temporarily extract fields at search time using regex -- but if you're not a regex ninja, use that Field Extract thing i mentioned.
And watch my video on "All My Regexs Live in Texas". It may be helpful.
© 2012 Created by Michael Wilde.
