Warren Myers' Merikebi My online archive

There are a couple ways to do what you’re asking for The first is to use the lookup table as a filter in your initial search, like this: index=ndx sourcetype=srctp NOT [|inputlookup mylookup | fields ip] Or, do a lookup, and keep all the entries that have a null value in the lookup’s other field …
Continue reading Answer by warren for Splunk search doesn’t match CSV lookup file

Presuming Splunk hasn’t already extracted these automatically (it looks close to JSON, perhaps), this will do it: index=ndx sourcetype=srctp | rex field=_raw "status\":(?<status>\d+)" | search status=0 from User warren – Stack Overflow https://stackoverflow.com/questions/42234216/extracting-particular-value-using-regex-in-splunk/73129772#73129772 via IFTTT

This will do it, based on your sample data: (?<username>[a-z0-9A-Z\-\_\.\w]+)(\s?)+$ There are probably more efficient formulations. If you don’t have spaces at the end of the line, you can use this: (?<username>[a-z0-9A-Z\-\_\.]+)$ from User warren – Stack Overflow https://stackoverflow.com/questions/56115480/regex-working-on-regex101-and-not-on-splunk/73129494#73129494 via IFTTT

For readibility, try using IN(): index=sne host=nwbsnep* sourcetype IN(sne_CAS_elilogs,sne_CMS_elilogs) Service.Operation IN("A","B","C","D","E","F","G","H") The issue seems to have been, though, that in your second parenthesized set of ORs, you had this: OR "Service.Operation"="D "OR "Service.Operation"="E" OR "Service.Operation"="F" In SPL, the OR has to be separated from what it’s or’ing by at least one space You had one …
Continue reading Answer by warren for Searching for specific values in Splunk query

In answering a Splunk question on SO, the following sample text was given: msg: abc.asia – [2021-08-23T00:27:08.152+0000] "GET /facts?factType=COMMERCIAL&sourceSystem=ADMIN&sourceOwner=ABC&filters=%257B%2522stringMatchFilters%2522:%255B%257B%2522key%2522:%2522BFEESCE((json_data-%253E%253E’isNotSearchable’)::boolean,%2520false)%2522,%2522value%2522:%2522false%2522,%2522operator%2522:%2522EQ%2522%257D%255D,%2522multiStringMatchFilters%2522:%255B%257B%2522key%2522:%2522json_data-%253E%253E’id’%2522,%2522values%2522:%255B%25224970111%2522%255D%257D%255D,%2522containmentFilters%2522:%255B%255D,%2522nestedMultiStringMatchFilter%2522:%255B%255D,%2522nestedStringMatchFilters%2522:%255B%255D%257D&sorts=%257B%2522sortOrders%2522:%255B%257B%2522key%2522:%2522id%2522,%2522order%2522:%2522DESC%2522%257D%255D%257D&pagination=null The person wanted to extract everything in the "filters" portion of the URL if "factType" was "COMMERCIAL" The following all-in-one regex pulls it out neatly (presuming the URL is always in the right order (ie factType …
Continue reading Why are sequential regular expressions more efficient than a combined experession?

Try this: index=ndx sourcetype=srctp msg=* | rex field=msg "factType=(?<facttype>\w+).(?<params>.+)" | stats count by facttype params | fields – count | search facttype="commercial" The rex will extract the facttype and any following parameters (note – if the URL is submitted with the arguments in a different order, you’ll need to adjust the regular expression) Then use …
Continue reading Answer by warren for Splunk Count Specific String in a Field

If you have not defined a sourcetype in an appropriate props.conf (and associated transforms.conf), Splunk will try to determine the sourcetype based on heuristics Those heuristics are not generally very accurate on custom data sources Instead of trying to "programatically set the sourcetype to be the namespace from where the logs were generated", add a …
Continue reading Answer by warren for Fluentd sending to Splunk HEC: Want to set sourcetype to the namespace

If you want to pass results of a Dashboard elsewhere, you need to use a drilldown See the Dashboard XML reference for more Splunk will only send to a URL, however – so if you want it to go to a "custom python script", it will need to be accessible via URL What does your …
Continue reading Answer by warren for Choose one result in Splunk table Query

If you’d like a full regex for extracting all of the bracketed fields, this is the most efficient one-shot I could make: | rex field=_raw "(?<extid>[\d\.]+).+D\[(?<fieldtype>[^\]]+).+T\[(?<format>[^\]]+).+L\[(?<ll>[^\]]+).+N\[(?<len>[^\]]+).+E\[(?<type>[^\]]+).+S\[(?<charset>[^\[]+).+A\[(?<data>[^\]]+)" Most often I do sequential rex calls, just in case some fields aren’t present in all events, but your sample data shows each of these items present Once you’ve …
Continue reading Answer by warren for Splunk search query

Checking your regex on regex101 shows that it fails – you’re looking to match a literal ", but it’s not there for your "null" value This regular expression is both simpler to read, and pulls what you’re looking for (without the extraneous comma): | rex field=Message "TimesAccessed[[:punct:]]+(?<TimesAccessed>[^\",]+)" Use the [[:punct:]] character class to match any …
Continue reading Answer by warren for Splunk rex Search – Unable to tabulate because of NULL