topic Re: query help in splunk cloud in Splunk Cloud Platform

query help in splunk cloud

Praz_123 — Fri, 22 Aug 2025 06:42:44 GMT

query is something like :-
`macro_1` index=abc sequenceNumber=12 `macro_2`

basically the below image had 4 column as and the events following there

If we see in the events the logs are missing for the seq no 17 & 24 and time is missing 15,16,17 and 24 also there is 15 and 16 events merge together how will I solve this

Re: query help in splunk cloud

ITWhisperer — Fri, 22 Aug 2025 07:07:14 GMT

Your problem appears to be either in macro_1 or macro_2 or both

Re: query help in splunk cloud

livehybrid — Fri, 22 Aug 2025 08:54:32 GMT

Hi @Praz_123

Without knowing exactly what the two macros are doing its unfortunately impossible for us to know what is going on. Please can you send the expanded version of the search or the contents of the macros?

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: query help in splunk cloud

Praz_123 — Fri, 22 Aug 2025 09:56:09 GMT

@livehybrid @ITWhisperer

macro 1:-
source="/data/splunk/layer7/*"

macro 2;-
| rex field=_raw "<detail (?<msg>[\d\D]*?)</params></detail>" max_match=150
| mvexpand msg
| rex field=msg "messageId=\"(?<Code>\S+)\"|ordinal=\"(?<SeqNo>\S+)\"|time=\"(?<DetTime>\S+)\"|<param>(?<Message>[\d\D]*?)</param>" max_match=150
| eval DetTime=DetTime/1000
| convert timeformat="%m/%d/%Y %H:%M:%S.%3Q" ctime(DetTime) AS Time
| table SeqNo, Time, Code, Message

while am running for other sequence number there is no issue for this the issue is

Re: query help in splunk cloud

isoutamo — Fri, 22 Aug 2025 12:31:43 GMT

Have you try to run this SPL with macros expanded?
You can do it in SPL box with key combinations Ctrl+Shift+E (windows) or Cmd+Shift+E (macOS).

With that way you could modify / comment out content of those macros and debug what will happen and where is the real issue.

Re: query help in splunk cloud

ITWhisperer — Fri, 22 Aug 2025 15:42:40 GMT

Some of your messages have multiple sequence numbers (ordinals) and some have no sequence number. Try looking at the actual events which are causing you the issue and determine whether the rex needs to be updated to extract the msg field correctly to alleviate this problem