query help in splunk cloud

[Praz_123]

query is something like :-
`macro_1` index=abc sequenceNumber=12 `macro_2`

basically the below image had 4 column as  and the events following there 

If we see in the events the logs are missing for the seq no 17 & 24 and time is missing 15,16,17 and 24 also there is 15 and 16 events merge together how will I solve this 

[isoutamo]

Have you try to run this SPL with macros expanded? 
You can do it in SPL box with key combinations Ctrl+Shift+E (windows) or Cmd+Shift+E (macOS).

With that way you could modify / comment out content of those macros and debug what will happen and where is the real issue.

[Praz_123]

@livehybrid @ITWhisperer 

macro 1:-
source="/data/splunk/layer7/*"



macro 2;-
| rex field=_raw "<detail (?<msg>[\d\D]*?)</params></detail>" max_match=150
| mvexpand msg
| rex field=msg "messageId=\"(?<Code>\S+)\"|ordinal=\"(?<SeqNo>\S+)\"|time=\"(?<DetTime>\S+)\"|<param>(?<Message>[\d\D]*?)</param>" max_match=150
| eval DetTime=DetTime/1000
| convert timeformat="%m/%d/%Y %H:%M:%S.%3Q" ctime(DetTime) AS Time
| table SeqNo, Time, Code, Message


while am running for other sequence number there is no issue for this the issue is 

[ITWhisperer]

Some of your messages have multiple sequence numbers (ordinals) and some have no sequence number. Try looking at the actual events which are causing you the issue and determine whether the rex needs to be updated to extract the msg field correctly to alleviate this problem

[livehybrid]

Hi @Praz_123 

Without knowing exactly what the two macros are doing its unfortunately impossible for us to know what is going on. Please can you send the expanded version of the search or the contents of the macros?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[ITWhisperer]

Your problem appears to be either in macro_1 or macro_2 or both