"How are these transactions linked together... by a field called "ID"? If so.. just build them with the field ID, and then use one of the MV commands to extract a field with success or failure in it. Paste some samples and…"
The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Nikita posted a discussionCount failures and success via transaction
Hi,I'm a new in Splunk so sorry for the stupid questions.I want to calculate failures in logs.For example we have request log and response log."request" OR ("fail" OR "response") |transaction startsWith=("request") endsWith=("fail" OR "response") maxpause=5s keepevicted=false maxspan=25s id |eval Failure=if(searchmatch("fail"),1,0)| eval Success=if(searchmatch("response"),1,0) | stats count(Failure) as FailureCount, count(Success) as SuccessCount | table FailureCount SuccessCountThat query…See More
The "I suck at regex" class at Splunk User conference
I'm planning on doing a really fun regex class during Splunk's user conference.... the premise is:
In this class, we'll make one of the most feared subjects "regex", totally fun! We'll teach you how to approach the dreaded "regular expressions" (RegEx). You will learn how Splunk uses regex in its product. You will learn how to do basic regex. You will learn how to identify patterns in your data. You will learn where you can use regex in Splunk. You will become far better at regex than you are now--even if you've never done it before. Guaranteed, this will be the best class at .conf!
Some people out ther don't think this class should happen. So if it was off the schedule, and i held it on my own time in a Suite at the Palace Hotel in SF.. would you come?
Views: 173
Replies to This Discussion
-
Permalink Reply by Mark Sleeper on -
Hi Michael,
I tried to respond to this already and I'm not sure it went through, so if this is a repeat please forgive.
I have been using Splunk for a little while and have written a few scripts using regex to make it automate some reports. I would like to learn more about regex though, so I would come to your class. I'm alredy registed for the splunk conference as well.
Thanks,
Mark
-
Permalink Reply by Chad Handley on
-
I have review your video many times and would definatley go to the class if offered. I am registered for the conference and really look forward to this.. Support is very hesitant to helping around this area and a class would be great.
-
Permalink Reply by Phillip Manning on
-
I would really appreciate a regex class. That would be incredibly helpful. I'll be at the conference, so I'm ready.
© 2012 Created by Michael Wilde.
