Index="ti-p_plasma" sourcetype="plasma: ops-gateway" earliest=-1h source="/home/zsvg9ky/deployments/ops-gateway/ops-gateway/logs/access*" ogw_uri!=.js ogw_uri!=.css ogw_uri!=.gif ogw_uri!=.jpeg ogw_uri!=.png ogw_uri!=.jpg ogw_uri!=.fonts ogw_uri!=.assets/ ogw_status_code!=201 ogw_status_code!=405 ogw_status_code!=206 I'm assuming your source type really does include a space after the colon: plasma: ops-gateway. There's no need to use a separate "search" command unless you've used one intentionally when constructing your search in code. "AND" is implied in Splunk searches, and you can include search terms directly in the base search. That works and produces a set of preselected statistics for all fields, but it's probably not what you intended. SearchQuery = 'index=main host="splunk1" source="/var/log/secure"|stats' Your fields command refers to fields that don't exist in your chart output. Your regular expression includes a space before the caret.Which genereting job sid then using below script to show the outputĬurl -k -H "Authorization:Splunk $token" $jobid/results_preview -get -d may just be typos in your message, but just in case: ServerContent = httplib2.Http(disable_ssl_certificate_validation=True).request(baseurl + '/services/auth/login', Password = 'index=main host="splunk1" source="/var/log/secure"|stats' Import urllib.request, urllib.parse, urllib.error I am using below python script but output is not producing nothing Index="ti-p_plasma" sourcetype="plasma: ops-gateway" earliest=-1h source ="/home/zsvg9ky/deployments/ops-gateway/ops-gateway/logs/access*" | search ogw_uri!=.js AND ogw_uri!=.css AND ogw_uri!=.gif AND ogw_uri!=.jpeg AND ogw_uri!=.png AND ogw_uri!=.jpg AND ogw_uri!=.fonts AND ogw_uri!=.assets/ | Rex field=ogw_uri " ^/(?+).*$" | chart count by end_point_services, ogw_status_code | field -"201","405","206" Please advice how we can do it with python script as AND operation seems not working We need to write a python script to pull data for below query ,using script below but no output is showing.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |