Hello - I am looking for recommendations on combining 2 searches that use the same Lookup CSV but different columns in the CSV as the link to the lookup.
Thank you all for taking a look and providing insights.
CSV lookup Columns
Job_Config_Name,Job,Job_Thread_Name,Frequency_mins,Job_Name,Job_Type,Job_Task,Active
Search 1
index="idx_cibca_App_prod" sourcetype = "tomcat:runtime:log:jpma" AND "lastUpdatedTS" OR "Time taken for" host=Server_1 OR host=Server_2 OR host=Server_3 OR host=Server_4 OR host=Server_5 OR host=Server_6 OR host=Server_7 OR host=Server_8
| rex "(?<Job_Thread_Name>[a-z].*Range)"
| rex "(?<DATE_TIME>^(\d+)-(\d+)-(\d+)(\s+)(\d+):(\d+):(\d+).(\d+))"
| stats latest(_time) as _time , latest(host) as host by Job_Thread_Name
| lookup App-Job-Index-Lookup.csv Job_Thread_Name OUTPUTNEW
| eval Thread_Last_Executed=strftime(_time, "%Y-%m-%d %I:%M:%S %p"), EPOC_Time=(_time)
| eval Lag=round((now()-EPOC_Time)/60)
| eval Status=if(isnull(Lag), "NOT OK - Job not running", if(Lag<= if(Frequency_mins>60, Frequency_mins+10, 70),"OK","NOT OK - Job not running - Lag found"))
| table Job_Name, host, Job_Thread_Name, Frequency_mins,Job_Config_Name, Thread_Last_Executed,Lag,Status,Job_Status,Job_Status_Logged,TIMETAKEN_IN_MINS
Search 2
index="idx_cibca_App_prod" sourcetype="tomcat:runtime:log:jpma" AND "Job Details job name:" host=Server_1 OR host=Server_2 OR host=Server_3 OR host=Server_4 OR host=Server_5 OR host=Server_6 OR host=Server_7 OR host=Server_8
| rex "Job Details job name:(?<Job_Config_Name>.*) status:(?<JOB_STATUS>.*) timetaken:(?<TIMETAKEN>.*) minutes"
| rex "(?<DATE_TIME>^(\d+)-(\d+)-(\d+)(\s+)(\d+):(\d+):(\d+).(\d+))"
| stats latest(DATE_TIME) AS Job_Status_Logged latest(JOB_STATUS) AS Job_Status, latest(TIMETAKEN) AS TIMETAKEN_IN_MINS by Job_Config_Name
| lookup App-Job-Index-Lookup.csv Job_Config_Name OUTPUT Job_Name, Frequency_mins, Job_Config_Name, Job_Thread_Name
| table Job_Name, Job_Thread_Name, Frequency_mins,Job_Status,Job_Status_Logged,TIMETAKEN_IN_MINS
