@warrenmyers π Jul. 26, 2022 π π₯ 11 | Avg. Guesses: 8.18 β¬β¬π© = 3 #globle — CatsFanInOhio πΊπ¦ (@michaeldf88) Jul 26, 2022 from http://twitter.com/michaeldf88 via IFTTT
Author:merikebi
Why are sequential regular expressions more efficient than a combined experession? https://t.co/6QPGaduqXb #regex
Why are sequential regular expressions more efficient than a combined experession? https://t.co/6QPGaduqXb #regex — Warren Myers π§πΏ (@warrenmyers) Jul 26, 2022 from Twitter https://twitter.com/warrenmyers July 26, 2022 at 04:02PM via IFTTT
Why are sequential regular expressions more efficient than a combined experession?
In answering a Splunk question on SO, the following sample text was given: msg: abc.asia – [2021-08-23T00:27:08.152+0000] "GET /facts?factType=COMMERCIAL&sourceSystem=ADMIN&sourceOwner=ABC&filters=%257B%2522stringMatchFilters%2522:%255B%257B%2522key%2522:%2522BFEESCE((json_data-%253E%253E’isNotSearchable’)::boolean,%2520false)%2522,%2522value%2522:%2522false%2522,%2522operator%2522:%2522EQ%2522%257D%255D,%2522multiStringMatchFilters%2522:%255B%257B%2522key%2522:%2522json_data-%253E%253E’id’%2522,%2522values%2522:%255B%25224970111%2522%255D%257D%255D,%2522containmentFilters%2522:%255B%255D,%2522nestedMultiStringMatchFilter%2522:%255B%255D,%2522nestedStringMatchFilters%2522:%255B%255D%257D&sorts=%257B%2522sortOrders%2522:%255B%257B%2522key%2522:%2522id%2522,%2522order%2522:%2522DESC%2522%257D%255D%257D&pagination=null The person wanted to extract everything in the "filters" portion of the URL if "factType" was "COMMERCIAL" The following all-in-one regex pulls it out neatly (presuming the URL is always in the right order (ie factType …
Continue reading Why are sequential regular expressions more efficient than a combined experession?
Answer by warren for Splunk Count Specific String in a Field
Try this: index=ndx sourcetype=srctp msg=* | rex field=msg "factType=(?<facttype>\w+).(?<params>.+)" | stats count by facttype params | fields – count | search facttype="commercial" The rex will extract the facttype and any following parameters (note – if the URL is submitted with the arguments in a different order, you’ll need to adjust the regular expression) Then use …
Continue reading Answer by warren for Splunk Count Specific String in a Field
Answer by warren for Fluentd sending to Splunk HEC: Want to set sourcetype to the namespace
If you have not defined a sourcetype in an appropriate props.conf (and associated transforms.conf), Splunk will try to determine the sourcetype based on heuristics Those heuristics are not generally very accurate on custom data sources Instead of trying to "programatically set the sourcetype to be the namespace from where the logs were generated", add a …
Continue reading Answer by warren for Fluentd sending to Splunk HEC: Want to set sourcetype to the namespace
Answer by warren for Choose one result in Splunk table Query
If you want to pass results of a Dashboard elsewhere, you need to use a drilldown See the Dashboard XML reference for more Splunk will only send to a URL, however – so if you want it to go to a "custom python script", it will need to be accessible via URL What does your …
Continue reading Answer by warren for Choose one result in Splunk table Query
Answer by warren for Splunk search query
If you’d like a full regex for extracting all of the bracketed fields, this is the most efficient one-shot I could make: | rex field=_raw "(?<extid>[\d\.]+).+D\[(?<fieldtype>[^\]]+).+T\[(?<format>[^\]]+).+L\[(?<ll>[^\]]+).+N\[(?<len>[^\]]+).+E\[(?<type>[^\]]+).+S\[(?<charset>[^\[]+).+A\[(?<data>[^\]]+)" Most often I do sequential rex calls, just in case some fields aren’t present in all events, but your sample data shows each of these items present Once you’ve …
Continue reading Answer by warren for Splunk search query
Answer by warren for Splunk rex Search – Unable to tabulate because of NULL
Checking your regex on regex101 shows that it fails – you’re looking to match a literal ", but it’s not there for your "null" value This regular expression is both simpler to read, and pulls what you’re looking for (without the extraneous comma): | rex field=Message "TimesAccessed[[:punct:]]+(?<TimesAccessed>[^\",]+)" Use the [[:punct:]] character class to match any …
Continue reading Answer by warren for Splunk rex Search – Unable to tabulate because of NULL
#Splunk #regex matching for Spring batch job times https://t.co/golfcIUqte
#Splunk #regex matching for Spring batch job times https://t.co/golfcIUqte — Warren Myers π§πΏ (@warrenmyers) Jul 26, 2022 from Twitter https://twitter.com/warrenmyers July 26, 2022 at 11:21AM via IFTTT
π on @YouTube: The Battleship Buried Inside a Mountain https://t.co/vaCgT0WMkC
π on @YouTube: The Battleship Buried Inside a Mountain https://t.co/vaCgT0WMkC — Warren Myers π§πΏ (@warrenmyers) Jul 26, 2022 from Twitter https://twitter.com/warrenmyers July 26, 2022 at 11:11AM via IFTTT
Appleβs Lockdown Mode https://t.co/dAXjoii2QH
Appleβs Lockdown Mode https://t.co/dAXjoii2QH — Warren Myers π§πΏ (@warrenmyers) Jul 26, 2022 from Twitter https://twitter.com/warrenmyers July 26, 2022 at 09:07AM via IFTTT
Jonathan Kay (@Quillette podcaster) “speaks with #Swedish #Marxist Malcom Kyeyune, who argues that nominally #progressive theories of race & gender are actually aimed at securing #influence, employment, & #prestige for #underemployed university graduates” https://t.co/ARA4wNjHMZ https://t.co/1W777W1mLZ
Jonathan Kay (@Quillette podcaster) “speaks with #Swedish #Marxist Malcom Kyeyune, who argues that nominally #progressive theories of race & gender are actually aimed at securing #influence, employment, & #prestige for #underemployed university graduates” https://t.co/ARA4wNjHMZ https://t.co/1W777W1mLZ — Warren Myers π§πΏ (@warrenmyers) Jul 26, 2022 from Twitter https://twitter.com/warrenmyers July 26, 2022 at 04:04AM via IFTTT
Favorite tweets
@malmesburyman @LatinxPutler @ploughmansfolly Fill little honey bears and sell them. I was able to buy a whole ‘nother hive with the money. And what will I do with that honey money you ask? buy another and another. You need to be honeymaxxing. You need to be swimming in honey. Winny-the-Pooh needs to be saying “Oh …
Continue reading Favorite tweets
π Jul 26, 2022 π π₯ 89 | Avg. Guesses: 7.11 β¬β¬π§π© = 4 #globle @michaeldf88
π Jul 26, 2022 π π₯ 89 | Avg. Guesses: 7.11 β¬β¬π§π© = 4 #globle @michaeldf88 — Warren Myers π§πΏ (@warrenmyers) Jul 26, 2022 from Twitter https://twitter.com/warrenmyers July 26, 2022 at 12:03AM via IFTTT
Favorite tweets
Their βtruthβ will not set you free. Only real truthβGodβs truth can do that. But youβve been led to believe thatβs βoppressiveβ. So now weβre facing the consequences. https://t.co/sTwje1S3v9 — Samuel Sey (@SlowToWrite) Jul 26, 2022 from http://twitter.com/SlowToWrite via IFTTT
Favorite tweets
This is what it looks like when narcissism takes over your theology. https://t.co/UJfOiOudvh — Megan Basham (@megbasham) Jul 26, 2022 from http://twitter.com/megbasham via IFTTT
RT @EdLatimore: They ruin reading for so many, so many never read again https://t.co/IuE5i1y1DA
RT @EdLatimore: They ruin reading for so many, so many never read again https://t.co/IuE5i1y1DA — Warren Myers π§πΏ (@warrenmyers) Jul 26, 2022 from Twitter https://twitter.com/warrenmyers July 25, 2022 at 10:50PM via IFTTT
Favorite tweets
Today I spent most of the program with the brilliant opening chapter of the LBCF. Did you know “all decrees of councils, opinions of ancient writers” are to be examined by the higher authority of Scripture? Yes indeed! https://t.co/Vs21EEupw3 — ππ₯π¦π±π’π π’ππ―π‘ (@HwsEleutheroi) Jul 26, 2022 from http://twitter.com/HwsEleutheroi via IFTTT
Favorite tweets
π Jul. 25, 2022 π π₯ 10 | Avg. Guesses: 8.7 β¬β¬π§π§π¨π₯π₯π¨ π§π§π§π₯π© = 13 #globle @warrenmyers — CatsFanInOhio πΊπ¦ (@michaeldf88) Jul 26, 2022 from http://twitter.com/michaeldf88 via IFTTT
#waffle186 3/5 π©π©π©π©π© π©βπ©β¬π© π©π©βπ©π© π©β¬π©βπ© π©π©π©π©π© π₯ streak: 32 π₯ #wafflesilverteam https://t.co/4doM5G9lQM
#waffle186 3/5 π©π©π©π©π© π©βπ©β¬π© π©π©βπ©π© π©β¬π©βπ© π©π©π©π©π© π₯ streak: 32 π₯ #wafflesilverteam https://t.co/4doM5G9lQM — Warren Myers π§πΏ (@warrenmyers) Jul 26, 2022 from Twitter https://twitter.com/warrenmyers July 25, 2022 at 10:20PM via IFTTT
Favorite tweets
Iβm teaching a module in this super awesome course by @RizomaSchool! Canβt wait! #foodpreservation #fermentation #canning https://t.co/0nhIA2m0aA — Kate Parsons (@kateparsonstv) Jul 25, 2022 from http://twitter.com/kateparsonstv via IFTTT
Answer by warren for Is there a similar command to multisearch in Splunk for non-streaming searches?
Non-streaming commands, by definition, run on the Search Head that initiated the search – and nowhere else. They’re typically expected to run after all the streaming searches have happened, for any finalization/manipulation of the returned data from all Search Peers running the search If you run non-streaming commands earlier than necessary in your SPL, you …
Continue reading Answer by warren for Is there a similar command to multisearch in Splunk for non-streaming searches?
βThat was their method of conducting art criticismβ https://t.co/ValeZAMjIG
βThat was their method of conducting art criticismβ https://t.co/ValeZAMjIG — Warren Myers π§πΏ (@warrenmyers) Jul 25, 2022 from Twitter https://twitter.com/warrenmyers July 25, 2022 at 11:19AM via IFTTT
π Jul 25, 2022 π π₯ 88 | Avg. Guesses: 7.13 β¬π§π₯π© = 4 #globle @michaeldf88
π Jul 25, 2022 π π₯ 88 | Avg. Guesses: 7.13 β¬π§π₯π© = 4 #globle @michaeldf88 — Warren Myers π§πΏ (@warrenmyers) Jul 25, 2022 from Twitter https://twitter.com/warrenmyers July 25, 2022 at 11:03AM via IFTTT
RT @RizomaSchool: I can’t say more details but my god american universities are the biggest racket they outsource everything they can to the people who can least afford it, take none of the risk, and get all of the money. it’s really really bad.
RT @RizomaSchool: I can’t say more details but my god american universities are the biggest racket they outsource everything they can to the people who can least afford it, take none of the risk, and get all of the money. it’s really really bad. — Warren Myers π§πΏ (@warrenmyers) Jul 25, 2022 from Twitter https://twitter.com/warrenmyers …
Continue reading RT @RizomaSchool: I can’t say more details but my god american universities are the biggest racket they outsource everything they can to the people who can least afford it, take none of the risk, and get all of the money. it’s really really bad.