"How are these transactions linked together... by a field called "ID"? If so.. just build them with the field ID, and then use one of the MV commands to extract a field with success or failure in it. Paste some samples and…"
The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Nikita posted a discussionCount failures and success via transaction
Hi,I'm a new in Splunk so sorry for the stupid questions.I want to calculate failures in logs.For example we have request log and response log."request" OR ("fail" OR "response") |transaction startsWith=("request") endsWith=("fail" OR "response") maxpause=5s keepevicted=false maxspan=25s id |eval Failure=if(searchmatch("fail"),1,0)| eval Success=if(searchmatch("response"),1,0) | stats count(Failure) as FailureCount, count(Success) as SuccessCount | table FailureCount SuccessCountThat query…See More
Perry's Discussions
Regex help
1 Reply
I am trying to pull out the hostname of a virus scan message and create a new field, but I am not having any luck. This is the part of the log I am trying to run a regex against: virus detected in…Continue
Started this discussion. Last reply by Michael Wilde Oct 3, 2011.
Perry's Page
Gifts Received
Perry has not received any gifts yet
Latest Activity
Michael Wilde replied to Perry's discussion Regex help"Perry... think it out... talk it out.. like this..
a backslash, ( followed by any character that is not a backslash ), followed by a backslash.
I put the parens around the phrase above, because we'll use that as a capturing…"
Perry posted a discussionRegex help
I am trying to pull out the hostname of a virus scan message and create a new field, but I am not having any luck. This is the part of the log I am trying to run a regex against: virus detected in \HOST001\SERVER-AV-1\I can't seem to get what is between the first \ and second \ Any help would be appreciated See More
Profile Information
- Are you an existing splunk user?
- Licensed
- What do you do for your day job?
- Security Analyst
Comment Wall
- No comments yet!
© 2012 Created by Michael Wilde.
