Search driven by KVStore parameters

stephendavisWK — Tue, 29 Sep 2020 15:45:10 GMT

I have a set of events similar to below and a working search for a single ID value of 133. My next step is to make the ID dynamic from a KVStore. My attempts so far have been unsuccessful and I could use some help. I am not even positive this is the right approach.

This is for a custom app for internal use so options are wide open on how to best approach this.
Ideas?

Events:
date time : Process Start for core instance ID: 133
date time : random message 1
date time : random message 5
date time : Process Ending ID: 133
date time : Process Start for core instance ID: 145
date time : random message 2
date time : random message 4
date time : random message 7
date time : Process Ending ID: 145
etc...

Working search:
index=myindex source=mysource
[search index=myindex ("Process Start" AND "ID: 133") | head 1 | eval earliest=_time | table earliest]
[search index=myindex ("Process Ending" AND "ID: 133") | head 1 | eval latest=_time+1 | table latest]
| eval StatusCode=
if((like(_raw, "%Process Start%") AND like(_raw, "%ID: 133%")), 1,
if(like(_raw, "%Process Ending%"), 2, 0))
| stats sum(StatusCode) as StatusCode, min(_time) as StartTime
| eval Started=if((StatusCode /1)>=1,"Success","Fail")
| eval Finished=if((StatusCode /2)>=1,"Success","Fail")
| eval Time=strftime(StartTime,"%c")
| table StartTime, evalVal1, evalVal2

Desired Results:
ID StartTime Started Finished
133 datetime Success Success
145 datetime Success Fail

Re: Search driven by KVStore parameters

stephendavisWK — Fri, 15 Sep 2017 14:05:28 GMT

Correction: "| table StartTime, evalVal1, evalVal2" in working search should be "| table StartTime, Started, Finished"

Re: Search driven by KVStore parameters

stephendavisWK — Fri, 17 Nov 2017 19:47:21 GMT

The final solution involved writing a python script which pulled data from a kvstore. Then using these parameters performing additional searches to gather events. The events were then accumulated in a json result set and returned to the client.

Re: Search driven by KVStore parameters

richgalloway — Fri, 17 Nov 2017 21:59:28 GMT

@stephendavisWK, if your problem is resolved, please accept the answer.

topic Re: Search driven by KVStore parameters in Knowledge Management

Search driven by KVStore parameters

Re: Search driven by KVStore parameters

Re: Search driven by KVStore parameters

Re: Search driven by KVStore parameters