Archive
Highlighted

Why is the below query not working?

Path Finder

I have to list the JobName orderid StartTime EndTime. i am using the below query but not getting the values for EndTime. can someone help me with this.

index="auto_prod_ctm"  sourcetype=daily_ctmag_sa_batch_log "STARTED" earliest=-30m |rex field=_raw "JOB (?.*) \(O"
| rex field=_raw "ORDERID (?[^,]+)"| eval Start_Time=strftime(_time,"%d/%m/%Y %I:%M:%S")|append [search index="auto_prod_ctm" sourcetype=daily_ctmag_sa_batch_log "ENDED OK" earliest=-30m |rex field=_raw "JOB (?.*) \(O" | rex field=_raw "ORDERID (?[^,]+)"|eval End_Time=strftime(_time,"%d/%m/%Y %I:%M:%S")] | table Job_Name orderid Start_Time End_Time
Tags (1)
0 Karma
Highlighted

Re: Why is the below query not working?

Ultra Champion

StartTime and EndTime come from separate events. Just peforming a table command doesn't merge taht into a single line with both StartTime and EndTime populated.

Try replacing the | table Job_Name orderid Start_Time End_Time with | stats values(Start_Time) as Start_Time values(End_Time) as End_Time by Job_Name,orderid.

If that doesn't solve it:
1. Please edit your question and put the search code in as code (using the 101010 button), otherwise it is hard to read and also some special characters will disappear
2. Please share sample events

0 Karma
Highlighted

Re: Why is the below query not working?

Builder

Hi,

you could join the two searches using the Job_Name and/or orderid information.
Please check:
http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Join

0 Karma
Highlighted

Re: Why is the below query not working?

Champion

In such a case, it is good to use the transaction command.

 index="auto_prod_ctm"  sourcetype=daily_ctmag_sa_batch_log  earliest=-30m 
|rex field=_raw "JOB (?.*) \(O" | rex field=_raw "ORDERID (?[^,]+)"
| transaction Job_Name orderid startswith="STARTED" endswith="ENDED OK"
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.