Get the latest event status of the Jobs (re-submitted repeatedly)

[arulbalans]

Splunk Query:

2016-06-12 00:48:29,834 INFO  [MainThread][PID:3143] item: AR001SJFBS valid_audio_path: /PROXY_AUDIO/2011/05/31/AR001SJFBS_3.mp2||/PROXY_AUDIO/2011/05/31/AR001SJFBS_4.mp2
2016-06-12 00:48:29,834 INFO  [MainThread][PID:3143] Item Submitted :: AR001SJFBS
2016-06-12 00:48:40,730 INFO  [MainThread][PID:3143] Item Processed :: AR001SJFBS, Transcode Status :: error

2016-06-27 08:30:20,169 INFO  [MainThread][PID:29112] item: AR001SJFBS valid_audio_path: /PROXY_AUDIO/2011/05/31/AR001SJFBS_3.mp2||/PROXY_AUDIO/2011/05/31/AR001SJFBS_4.mp2
2016-06-27 08:30:20,169 INFO  [MainThread][PID:29112] Item Submitted :: AR001SJFBS
2016-06-27 08:51:56,680 INFO  [MainThread][PID:29112] update metadat:: file system check True, new access path L:\PROXY\2011\05\31\AR001SJFBS.mp4
2016-06-27 08:52:13,879 INFO  [MainThread][PID:29112] Existing proxy backup at P:\MPEG_Backup\PROXY\2011\05\31\AR001SJFBS.mpeg ::
2016-06-27 08:52:13,879 INFO  [MainThread][PID:29112] Item Processed :: AR001SJFBS, Transcode Status :: completed 

From the above log
I'm re-submitting jobs that are failed with error/aborted/failed status. So possibilities of repeated proxies are present in the list.
I have to treat the transcode status of "AR001SJFBS" as "completed" instead "error" since completed is the latest status.

Thanks, Arul

[sundareshr · Accepted solution]

Try this

... | rex "PID:(?<job>\d+)\]\sItem\s(|?<status>\w+)" | eval status=if(status="AR*", "Completed", status) | stats latest(status) as status by job

[arulbalans]

Thank you Sundaresh!