How to get multiple events in single row of table?

archananaveen — Mon, 29 Jan 2018 18:35:29 GMT

I search logs for these strings: "member left" OR "left cluster" OR "asking member". It gives below output. These events are related to a node/ member and come different sources across hosts. Now I want to display in a table time "asking member leave time" and "notice event time" in a single row. How can I achieve this?

[DEBUG] 2018-01-28 23:07:37.193/40.500 Oracle Coherence GE 12.2.1.0.1  (thread=DistributedCache:DED-OTCM-PartitionedService, member=2): Asking member 1 for primary ownership of PartitionSet{0, 3, 6, 9, 12, 15, 18, 21, 24, 27, 30, 33, 36, 39, 42, 45, 48, 51, 54, 57, 60, 63, 66, 69, 72, 75, 78, 81, 84, 87, 90, 93, 96, 99, 102, 105, 108, 111, 114, 117, 120, 123, 126, 129, 132, 135, 138, 141, 144, 147, 150, 153, 156, 159, 162, 165, 168, 171, 174, 177, 180, 183, 186, 189, 192, 195, 198, 201, 204, 207, 210, 213, 216, 219, 222, 225, 228, 231, 234, 237, 240, 243, 246, 249, 252, 255, 258, 261, 264, 267, 270, 273, 276, 279, 282, 285, 288, 291, 294, 297, 300, 303, 306, 309, 312, 315, 318, 321, 324, 327, 330, 333, 336, 339, 342, 345, 348, 351, 354, 357, 360, 363, 366, 369, 372, 375, 378, 381, 384, 387, 390, 393, 396, 399, 402, 405, 408, 411, 414, 417, 420, 423, 426, 429}


[DEBUG] 2018-01-28 23:07:37.145/40.452 Oracle Coherence GE 12.2.1.0.1  (thread=DistributedCache:DED-OTC-PartitionedService, member=2): Asking member 1 for primary ownership of PartitionSet{0, 3, 6, 9, 12, 15, 18, 21, 24, 27, 30, 33, 36, 39, 42, 45, 48, 51, 54, 57, 60, 63, 66, 69, 72, 75, 78, 81, 84, 87, 90, 93, 96, 99, 102, 105, 108, 111, 114, 117, 120, 123, 126, 129, 132, 135, 138, 141, 144, 147, 150, 153, 156, 159, 162, 165, 168, 171, 174, 177, 180, 183, 186, 189, 192, 195, 198, 201, 204, 207, 210, 213, 216, 219, 222, 225, 228, 231, 234, 237, 240, 243, 246, 249, 252, 255, 258, 261, 264, 267, 270, 273, 276, 279, 282, 285, 288, 291, 294, 297, 300, 303, 306, 309, 312, 315, 318, 321, 324, 327, 330, 333, 336, 339, 342, 345, 348, 351, 354, 357, 360, 363, 366, 369, 372, 375, 378, 381, 384, 387, 390, 393, 396, 399, 402, 405, 408, 411, 414, 417, 420, 423, 426, 429}

[DEBUG] 2018-01-28 23:04:13.308/86254.373 Oracle Coherence GE 12.2.1.0.1  (thread=Cluster, member=8): Member(Id=5, Timestamp=2018-01-28 23:04:13.308, Address=1.1.1.19:10088, MachineId=64900, Location=machine:xxxxxx4a0209,process:29828,member:MRC-OTC-Partitioned-node4, Role=CoherenceServer) left Cluster with senior member 8

[DEBUG] 2018-01-28 23:04:13.016/86254.081 Oracle Coherence GE 12.2.1.0.1  (thread=Cluster, member=8): Member(Id=6, Timestamp=2018-01-28 23:04:13.016, Address=1.1.1.17:10090, MachineId=9445, Location=machine:xxxxxx3a0209,process:130402,member:MRC-OTC-Extend-node7, Role=CoherenceServer) left Cluster with senior member 5

[DEBUG] 2018-01-28 23:04:12.957/86254.022 Oracle Coherence GE 12.2.1.0.1  (thread=Cluster, member=8): Member(Id=7, Timestamp=2018-01-28 23:04:12.957, Address=1.1.1.17:10088, MachineId=9445, Location=machine:xxxxxx3a0209,process:130202,member:MRC-OTC-Partitioned-node3, Role=CoherenceServer) left Cluster with senior member 5

[DEBUG] 2018-01-28 23:04:12.707/86253.772 Oracle Coherence GE 12.2.1.0.1  (thread=Cluster, member=8): Member(Id=3, Timestamp=2018-01-28 23:04:12.707, Address=1.1.1.15:10090, MachineId=19526, Location=machine:xxxxxx2a0209,process:101777,member:MRC-OTC-Extend-node6, Role=CoherenceServer) left Cluster with senior member 5

Re: How to get multiple events in single row of table?

somesoni2 — Mon, 29 Jan 2018 19:06:28 GMT

Do all these events have a common field? If yes, then you can use stats to group multiple events into single row. E.g.

your current search which includes commonField and otherField1, otherField2...
| stats values(otherField1) as otherField1 values(otherField2) as otherField2... by commonField

Re: How to get multiple events in single row of table?

archananaveen — Mon, 29 Jan 2018 21:38:18 GMT

Yes fields are common. However, notice messages has Member(Id=*** in it. I want to construct a table rows if Member(Id= is false. In that row, I want to add the timestamp of events having Member(Id=** and the ID number. Can you please suggest?

_time    Departure Node      Notice Node         Notice node timestamp

xxxxx    member 2                member 8             xxxxxxxx

Re: How to get multiple events in single row of table?

somesoni2 — Tue, 30 Jan 2018 05:39:28 GMT

What should be the output based on your sample data? There are multiple events with string "asking member" and "left cluster", so which should be considered for timestamps?

Re: How to get multiple events in single row of table?

archananaveen — Tue, 30 Jan 2018 14:22:37 GMT

Thanks for your comment. I see your point. For now let's leave the duplicates we are seeing for asking member. However, we would need to consider all the events for left cluster. Do you have any suggestion on how to do that?

Re: How to get multiple events in single row of table?

somesoni2 — Tue, 30 Jan 2018 15:15:01 GMT

So out of all the events for left cluster, whose timestamp should we take? Again, What should be the output based on your sample data?

topic Re: How to get multiple events in single row of table? in Splunk Search

How to get multiple events in single row of table?

Re: How to get multiple events in single row of table?

Re: How to get multiple events in single row of table?

Re: How to get multiple events in single row of table?

Re: How to get multiple events in single row of table?

Re: How to get multiple events in single row of table?