Splunk Search

Get the latest event status of the Jobs (re-submitted repeatedly)

arulbalans
Engager

Splunk Query:

2016-06-12 00:48:29,834 INFO  [MainThread][PID:3143] item: AR001SJFBS valid_audio_path: /PROXY_AUDIO/2011/05/31/AR001SJFBS_3.mp2||/PROXY_AUDIO/2011/05/31/AR001SJFBS_4.mp2
2016-06-12 00:48:29,834 INFO  [MainThread][PID:3143] Item Submitted :: AR001SJFBS
2016-06-12 00:48:40,730 INFO  [MainThread][PID:3143] Item Processed :: AR001SJFBS, Transcode Status :: error

2016-06-27 08:30:20,169 INFO  [MainThread][PID:29112] item: AR001SJFBS valid_audio_path: /PROXY_AUDIO/2011/05/31/AR001SJFBS_3.mp2||/PROXY_AUDIO/2011/05/31/AR001SJFBS_4.mp2
2016-06-27 08:30:20,169 INFO  [MainThread][PID:29112] Item Submitted :: AR001SJFBS
2016-06-27 08:51:56,680 INFO  [MainThread][PID:29112] update metadat:: file system check True, new access path L:\PROXY\2011\05\31\AR001SJFBS.mp4
2016-06-27 08:52:13,879 INFO  [MainThread][PID:29112] Existing proxy backup at P:\MPEG_Backup\PROXY\2011\05\31\AR001SJFBS.mpeg ::
2016-06-27 08:52:13,879 INFO  [MainThread][PID:29112] Item Processed :: AR001SJFBS, Transcode Status :: completed 

From the above log
I'm re-submitting jobs that are failed with error/aborted/failed status. So possibilities of repeated proxies are present in the list.
I have to treat the transcode status of "AR001SJFBS" as "completed" instead "error" since completed is the latest status.

Thanks, Arul

0 Karma
1 Solution

sundareshr
Legend

Try this

... | rex "PID:(?<job>\d+)\]\sItem\s(|?<status>\w+)" | eval status=if(status="AR*", "Completed", status) | stats latest(status) as status by job

View solution in original post

0 Karma

sundareshr
Legend

Try this

... | rex "PID:(?<job>\d+)\]\sItem\s(|?<status>\w+)" | eval status=if(status="AR*", "Completed", status) | stats latest(status) as status by job
0 Karma

arulbalans
Engager

Thank you Sundaresh!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...