topic To create a Workflow in Splunk in Getting Data In

To create a Workflow in Splunk

Real_captain — Wed, 29 Jan 2025 12:14:44 GMT

Hi

Is it possible to create a workflow like below in Splunk.

We have 5 jobs running everyday and the start/end time with status is captured in the Splunk logs.

We want to create a workflow as below using the start/end time and status of the jobs:

Re: To create a Workflow in Splunk

gcusello — Wed, 29 Jan 2025 13:34:20 GMT

Hi @Real_captain ,

your request is just a little vague.

what do you want to monitor:

that all the steps are correctly completed?

that they are completed in the prefixed time,

what else?

is there a transaction_Id or something else to correlate events?

the five steps have a daily frequency or which one?

Then, what do you want to display, could you share a sample of the output that you would have?

Ciao.

Giuseppe

Re: To create a Workflow in Splunk

Real_captain — Wed, 29 Jan 2025 13:51:42 GMT

HI @gcusello
Request is to display the status of the jobs in the format as attached below in the excel.
1. These jobs ( Job A , Job B , Job C , Job D, Job E, Job F) are executed once a day and the start time/end time/status of these jobs are captured in splunk. We need to monitor these jobs and highlight the status

Sample of output we would like in our dashboard:

Re: To create a Workflow in Splunk

gcusello — Wed, 29 Jan 2025 14:02:24 GMT

Hi @Real_captain ,

ok, try something like this:

<your_search> | stats values("Start Time") AS "Start Time" values("End Time") AS "End Time" values(Status) AS Status BY Job | transpose column_name=Job header_field=Job

Please, check the syntax of the transpose command because I cannot test it.

Ciao.

Giuseppe