<StartTime>****</StartTime> filed is missing for few transaction IDs in Splunk result

[VinodP_410]

Hi Team,

I am running below query in Splunk and not showing <StartTime> line  for few "TransactionID".

Expected output: 

============

<StartTime>2021-05-01T16:24:00.9-07:00</StartTime>

<EndTime>2021-05-01T16:24:03.129-07:00</EndTime> <ExecutionTimeInMs>2229</ExecutionTimeInMs>

Result :

=====

<EndTime>2021-05-01T16:24:03.129-07:00</EndTime> <ExecutionTimeInMs>2229</ExecutionTimeInMs>

Query:

======

index="eai_prod" sourcetype="eai:tibco:webservices6.5" source="*appnodes/ShipmentOrderCreate*" ":ProcessExecutionStats>" | rex field=_raw "<CorrelationId>(?P<CorrelationId>.*?)<"| rex field=_raw "<CustomerNumber>(?P<CustomerNumber>.*?)<" | rex field=_raw "<TransactionStatus>(?P<TransactionStatus>.*?)<" | rex field=_raw "<JobId>(?P<JobId>.*?)<" | rex field=_raw "<CountryCode>(?P<CountryCode>.*?)<" | rex field=_raw "<StartTime>(?P<StartTime>.*?)<"| rex field=_raw "<EndTime>(?P<EndTime>.*?)<"| rex field=_raw "<ExecutionTimeInMs>(?P<ExecutionTimeInMs>.*?)<" | rename CorrelationId AS TransactionID CustomerNumber AS CustomerNumber TransactionStatus AS Status JobId AS JobId CountryCode AS CountryCode StartTime AS StartTime EndTime AS EndTime ExecutionTimeInMs AS ExecutionTime(ms) | table TransactionID CustomerNumber Status JobId CountryCode StartTime EndTime ExecutionTime(ms) | Sort -EndTime

[ITWhisperer]

Can you share the raw (anonymised) events that you are having difficulty with?

[VinodP_410]

Hi @ITWhisperer , 

here is the sample output events for one TransactionID.

<EndTime>2021-05-02T17:32:03.415-07:00</EndTime> <ExecutionTimeInMs>3201</ExecutionTimeInMs> <CorrelationId>PDC7_689081105_2181_ORD</CorrelationId>

<JobId>bw0a10d19</JobId>

<TransactionStatus>SUCCESS</TransactionStatus>

<CountryCode>USA</CountryCode>

<CustomerNumber>562545</CustomerNumber>

<FailureType>NOTAPPLICABLE</FailureType>

</ansbw6:ProcessExecutionStats>

TransactionID = PDC7_689081105_2181_ORD

Thanks!

[ITWhisperer]

There is no start time in the event - where do you expect this to be coming from?

[VinodP_410]

Hi @ITWhisperer , 

We are logging from TIBCO BW server to splunk, below is the BW server log, you can see StartTime filed. 

Whereas StartTime filed is not appear in Splunk UI.

2021-05-02 17:32:03.415 INFO [bwEngThread:In-Memory Process Worker-2] com.tibco.bw.palette.generalactivities.Log.SplunkEAILoggingLibrary.WriteExecutionStatsToLog - ProcessExecutionStats-Shi
pmentOrderCreate_v1_0: <?xml version="1.0" encoding="UTF-8"?>
<ansbw6:ProcessExecutionStats xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:ansbw6="/Processes/Common/ExecutionStatsFramework_v1_0.process/RenderExecutionStats" xmlns:tib="http://www.ti
bco.com/bw/xslt/custom-functions">
<ServiceName>ShipmentOrderCreate_v1_0</ServiceName>
<StartTime>2021-05-02T17:32:00.214-07:00</StartTime>
<EndTime>2021-05-02T17:32:03.415-07:00</EndTime>
<ExecutionTimeInMs>3201</ExecutionTimeInMs>
<CorrelationId>PDC7_689081105_2181_ORD</CorrelationId>
<JobId>bw0a10d19</JobId>
<TransactionStatus>SUCCESS</TransactionStatus>
<CountryCode>USA</CountryCode>
<CustomerNumber>562545</CustomerNumber>
<FailureType>NOTAPPLICABLE</FailureType>
</ansbw6:ProcessExecutionStats>

[ITWhisperer]

So, it looks like everything before the <EndTime> has been stripped presumably when the event was ingested. Do you have access to the relevant config, as you probably need to check that?

[VinodP_410]

Yes , I do have access to check configuration files on server, May I know which configurations I need to check.

Thanks!!

[ITWhisperer]

props and transforms for the source type in question.

[VinodP_410]

Hi @ITWhisperer 

Path : //splunkforwarder/etc/system/local

cat props.conf

[eai:tibco:webservices6.5]
MAX_TIMESTAMP_LOOKAHEAD=25
NO_BINARY_CHECK=1
TIME_FORMAT=%Y-%m-%d %H:%M:%S.%3N
TIME_PREFIX=^
TRUNCATE = 50000

Nothing has configured in "transforms.conf"

[ITWhisperer]

When you shared the "sample output events for one TransactionID" was that the _raw field?

[VinodP_410]

Yes, I have shared the output of below query

index="eai_prod" sourcetype="eai:tibco:webservices6.5" source="*appnodes/ShipmentOrderCreate*" ":ProcessExecutionStats>" | rex field=_raw "<CorrelationId>(?P<CorrelationId>.*?)<" | rex field=_raw "<CustomerNumber>(?P<CustomerNumber>.*?)<" | rex field=_raw "<TransactionStatus>(?P<TransactionStatus>.*?)<" | rex field=_raw "<JobId>(?P<JobId>.*?)<" | rex field=_raw "<CountryCode>(?P<CountryCode>.*?)<" | rex field=_raw "<StartTime>(?P<StartTime>.*?)<" | rex field=_raw "<EndTime>(?P<EndTime>.*?)<" | rex field=_raw "<ExecutionTimeInMs>(?P<ExecutionTimeInMs>.*?)<" | rename CorrelationId AS TransactionID CustomerNumber AS CustomerNumber TransactionStatus AS Status JobId AS JobId CountryCode AS CountryCode StartTime AS StartTime EndTime AS EndTime ExecutionTimeInMs AS ExecutionTime(ms) | search TransactionID=PDC7_689081105_2181_ORD

[VinodP_410]

Team,

Any help on below issue please?