Splunk Search

Get the latest event status of the Jobs (re-submitted repeatedly)

Engager

Splunk Query:

2016-06-12 00:48:29,834 INFO  [MainThread][PID:3143] item: AR001SJFBS valid_audio_path: /PROXY_AUDIO/2011/05/31/AR001SJFBS_3.mp2||/PROXY_AUDIO/2011/05/31/AR001SJFBS_4.mp2
2016-06-12 00:48:29,834 INFO  [MainThread][PID:3143] Item Submitted :: AR001SJFBS
2016-06-12 00:48:40,730 INFO  [MainThread][PID:3143] Item Processed :: AR001SJFBS, Transcode Status :: error

2016-06-27 08:30:20,169 INFO  [MainThread][PID:29112] item: AR001SJFBS valid_audio_path: /PROXY_AUDIO/2011/05/31/AR001SJFBS_3.mp2||/PROXY_AUDIO/2011/05/31/AR001SJFBS_4.mp2
2016-06-27 08:30:20,169 INFO  [MainThread][PID:29112] Item Submitted :: AR001SJFBS
2016-06-27 08:51:56,680 INFO  [MainThread][PID:29112] update metadat:: file system check True, new access path L:\PROXY\2011\05\31\AR001SJFBS.mp4
2016-06-27 08:52:13,879 INFO  [MainThread][PID:29112] Existing proxy backup at P:\MPEG_Backup\PROXY\2011\05\31\AR001SJFBS.mpeg ::
2016-06-27 08:52:13,879 INFO  [MainThread][PID:29112] Item Processed :: AR001SJFBS, Transcode Status :: completed 

From the above log
I'm re-submitting jobs that are failed with error/aborted/failed status. So possibilities of repeated proxies are present in the list.
I have to treat the transcode status of "AR001SJFBS" as "completed" instead "error" since completed is the latest status.

Thanks, Arul

0 Karma
1 Solution

Legend

Try this

... | rex "PID:(?<job>\d+)\]\sItem\s(|?<status>\w+)" | eval status=if(status="AR*", "Completed", status) | stats latest(status) as status by job

View solution in original post

0 Karma

Legend

Try this

... | rex "PID:(?<job>\d+)\]\sItem\s(|?<status>\w+)" | eval status=if(status="AR*", "Completed", status) | stats latest(status) as status by job

View solution in original post

0 Karma

Engager

Thank you Sundaresh!

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!