Splunk Search

Generic search to pull Job Name

harsush
Path Finder

20170221/032119.169 - U0020408 UC4ALERT: External Dependency inside jobplan NEWREL.JOBPLAN.X. CLEAN.SET_PARA.RTH_FOR_LOAD, (Run # 22222222) has been executing longer than expected; Please investigate.

20170221/010037.065 - U0011544 Max. runtime of task 'NEWREL.FILEEVNT.U.CLEAN.FIX.LOOK_FOR_IMR_FILE_IN_FTP' (RunID '11111111') has been exceeded. Task 'SYSTEM.SCRIPT.X.UC4.X.OBJ_RUNNING_TOO_LONG' will be started.

20170221/020123.758 - U0011007 Job 'CERT.JOBS.U.CVR.POS.CYC_DATE_LOAD' (RunID '444444444' / Workflow-RunID: '333333333') on Host 'CLCEPOS0001LD' ended abnormally (return code='0000000001'). Remote ID=13388

output
NEWREL.JOBPLAN.X. CLEAN.SET_PARA.RTH_FOR_LOAD
NEWREL.FILEEVNT.U.CLEAN.FIX.LOOK_FOR_IMR_FILE_IN_FTP
CERT.JOBS.U.CVR.POS.CYC_DATE_LOAD

Tags (1)
0 Karma

adayton20
Contributor

This seemed to work for me. Give it a try:

index=yourindex
| rex field=_raw "jobplan\s(?P<job1>.[^\,]*)" 
| rex field=_raw "task\s\'(?P<job2>.[^\']*)" 
| rex field=_raw "Job\s\'(?P<job3>.[^\']*)" 
| eval job=coalesce(job1,job2,job3) 
| table job

alt text

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...