"How are these transactions linked together... by a field called "ID"? If so.. just build them with the field ID, and then use one of the MV commands to extract a field with success or failure in it. Paste some samples and…"
The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Nikita posted a discussionCount failures and success via transaction
Hi,I'm a new in Splunk so sorry for the stupid questions.I want to calculate failures in logs.For example we have request log and response log."request" OR ("fail" OR "response") |transaction startsWith=("request") endsWith=("fail" OR "response") maxpause=5s keepevicted=false maxspan=25s id |eval Failure=if(searchmatch("fail"),1,0)| eval Success=if(searchmatch("response"),1,0) | stats count(Failure) as FailureCount, count(Success) as SuccessCount | table FailureCount SuccessCountThat query…See More
Transforms using regex and case insensitivity
I have three stanzas in my transforms.conf file--these work as long as the case matches what's in my regex statement.
How do I make "productimages" case insensitive?
REGEX = /productimages/[a-z0-9_-]+\.jpg
TIA,
Craig
How do I make "productimages" case insensitive?
REGEX = /productimages/[a-z0-9_-]+\.jpg
TIA,
Craig
Tags: case, insensitive, regex, transforms.conf
Views: 111
Replies to This Discussion
-
Permalink Reply by Michael Wilde on -
Put a (?i) at the beginning and it'll switch
it to case insensitive. Splunk's own Field Extraction wizard almost always adds that at the beginning of any learned regex.
-
Permalink Reply by Craig Fels on -
Thanks, we've added that to our transforms.conf (on 3 different stanzas) and it works.
FYI, one of our developers asked me "what type of regex does Splunk support?". I have no idea what the answer to that is, and couldn't find it in the KB on splunk.com.
What is the correct answer?
-
Permalink Reply by Michael Wilde on
-
PCRE or "Perl Compatible Regular Expressions"
© 2012 Created by Michael Wilde.
