Monitoring Splunk

CommonBaseEvent treatment

benji00
New Member

Hello all,

I receiving some event from our Monitoring Agent tool (from the editor Dassault Systemes) through Common Base Event format like:

  <extendedDataElements name="status" type="string">
    <values>0</values>
  </extendedDataElements>
  <extendedDataElements name="elapsed" type="string">
    <values>203</values>
  </extendedDataElements>
  <extendedDataElements name="_period" type="string">
    <values>300</values>
  </extendedDataElements>
  <extendedDataElements name="connection" type="string">
    <values>47</values>
  </extendedDataElements>
  <extendedDataElements name="logoutTime" type="string">
    <values>62</values>
  </extendedDataElements>
  <extendedDataElements name="getLoginPageTime" type="string">
    <values>78</values>
  </extendedDataElements>
  <sourceComponentId componentType="ProductName" instanceId="3dpassport_TEST1" component="serviceHealthCheck" processId="" locationType="Hostname" location="io-ws-3de71ts" subComponent="" componentIdType="ProductName"/>
  <situation categoryName="ReportSituation">
    <situationType reportCategory="LOG" xsi:type="ReportSituation" reasoningScope="INTERNAL"/>
  </situation>
</CommonBaseEvent>

I don't really understand how can I operate for example the "ELAPSED" extended elements and moreover be able to track his value evolution
Any clue on your side?

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...