topic Re: Need help with Splunk Query in Splunk Search

Need help with Splunk Query

nilbak1 — Sat, 25 Jul 2020 09:12:32 GMT

Hi All.

I need help with Splunk Query for below scenario:

I need to show the status of my cronjob in below format.

Starttime	FinishTIme	CurrentStatus
Time when Job Starts	Time when Job Finishes	Started/Running/Finished

Start:-
INFO | jvm 1 | main | 2020/07/16 03:30:08.407 xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Found 13 set of files to process

End:-
INFO | jvm 1 | main | 2020/07/16 04:21:57.914 xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Ended . RESULT :true

In between there are many lines for which status should be running..

Thanks in dvance

Re: Need help with Splunk Query

isoutamo — Sat, 25 Jul 2020 10:35:20 GMT

is the “jvm 1” and “main” same for all steps in one job? How you can separate the another jobs on log files/events?

r. Ismo

Re: Need help with Splunk Query

nilbak1 — Sat, 25 Jul 2020 11:53:07 GMT

Yes , its same for all the the events.
I am using the common string in the search query for the job for which I want to print the below message.

Re: Need help with Splunk Query

isoutamo — Sat, 25 Jul 2020 12:33:32 GMT

This works with one batch, if there are more, then you need to update that query.

| makeresults | eval _raw="INFO | jvm 1 | main | 2020/07/16 03:30:08.407 xxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Found 13 set of files to process INFO | jvm 1 | main | 2020/07/16 04:21:57.914 xxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Satus . RESULT :true INFO | jvm 1 | main | 2020/07/16 04:21:57.914 xxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Ended . RESULT :true" | multikv noheader=t | eval jvm=Column_3, step=Column_6 | rex "Ended\s+\.\s+RESULT\s+:(?<result>\w+)" | rex "Found\s+(?<noFiles>\d+) set of files to process" | stats earliest(_time) as Starttime latest(_time) as FinishTime count as noStatus values(result) as result values(noFiles) as noFiles by jvm step | eval CurrentStatus = case(isnotnull(result), "Finished", noStatus > 1, "Running", isnotnull(noFiles), "Started", true(), "Unkown status") | eval Starttime = strftime(Starttime, "%c"), FinishTime = strftime(FinishTime, "%c") | table Starttime FinishTime CurrentStatus

Re: Need help with Splunk Query

nilbak1 — Mon, 27 Jul 2020 12:30:28 GMT

Thanks a ton.
It worked like a gem.

I am able to create Splunk query based on you suggestion.
Thanks again