topic Why is the below query not working? in Splunk Search

Why is the below query not working?

abhi04 — Tue, 29 Sep 2020 19:56:58 GMT

I have to list the Job_Name orderid Start_Time End_Time. i am using the below query but not getting the values for End_Time. can someone help me with this.

index="auto_prod_ctm"  sourcetype=daily_ctmag_sa_batch_log "STARTED" earliest=-30m |rex field=_raw "JOB (?.*) \(O"
| rex field=_raw "ORDERID (?[^,]+)"| eval Start_Time=strftime(_time,"%d/%m/%Y %I:%M:%S")|append [search index="auto_prod_ctm" sourcetype=daily_ctmag_sa_batch_log "ENDED OK" earliest=-30m |rex field=_raw "JOB (?.*) \(O" | rex field=_raw "ORDERID (?[^,]+)"|eval End_Time=strftime(_time,"%d/%m/%Y %I:%M:%S")] | table Job_Name orderid Start_Time End_Time

Re: Why is the below query not working?

FrankVl — Tue, 29 Sep 2020 19:57:14 GMT

Start_Time and End_Time come from separate events. Just peforming a table command doesn't merge taht into a single line with both Start_Time and End_Time populated.

Try replacing the | table Job_Name orderid Start_Time End_Time with | stats values(Start_Time) as Start_Time values(End_Time) as End_Time by Job_Name,orderid.

If that doesn't solve it:
1. Please edit your question and put the search code in as code (using the 101010 button), otherwise it is hard to read and also some special characters will disappear
2. Please share sample events

Re: Why is the below query not working?

poete — Fri, 08 Jun 2018 14:22:53 GMT

Hi,

you could join the two searches using the Job_Name and/or orderid information.
Please check:
http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Join

Re: Why is the below query not working?

HiroshiSatoh — Fri, 08 Jun 2018 15:08:04 GMT

In such a case, it is good to use the transaction command.

 index="auto_prod_ctm"  sourcetype=daily_ctmag_sa_batch_log  earliest=-30m 
|rex field=_raw "JOB (?.*) \(O" | rex field=_raw "ORDERID (?[^,]+)"
| transaction Job_Name orderid startswith="STARTED" endswith="ENDED OK"