I have the following job run details getting indexed:
JobName JobStartTime JobEndTime JobStatus APM1234, 01/11/19 09:00, 01/11/19 09:30, COMPLETE APM1235, 01/11/19 09:05, 01/11/19 09:35, FAILED APM1236, 01/11/19 09:10, 01/11/19 09:40, RUNNING APM1237, 01/11/19 09:15, 01/11/19 09:45, RUNNING
I wanted to create a form for the user that shows up FAILED jobs in last 24 hours and they should be able to add an event when a job was force completed. Eg. Suppose if the user marks the job APM1235 as force completed, the following event should be added:
JobName JobStartTime JobEndTime JobStatus APM1235, 01/11/19 09:05, 01/11/19 09:35, FORCE-COMPLETED
This is possible in Splunk? Any help is appreciated. Thank you so much!
May be you can create a custom command which will do the indexing using "data/inputs/oneshot
" endpoint. When user make the job force-completed from UI you can call the custom command.
Please refer the below link for end point details.
Yes, there are many ways to build this in Splunk.
| makeresults | sendalert logevent param.event="Hello World!" [obviously with more stuff configured for the
I'm sure there are more options.