Splunk Search

How to Collate Events By Matching String?

ZCAMZ
Loves-to-Learn Lots

Hi All,

Im trying use Splunk to produce a table which will highlight the duration between the RUNNING event of one and the SUCCESS event of another Autosys job.

In this case the start job for each environment is denoted by a prefix ending *START_COMP_0 and the last job is *OSMPCONTROL_0.

If I only compare a single environment (ENV1...) then the search works fine however I would like to grab the duration between two events for multiple environments (ENV1, ENV2...).  Using the SPL below or something similar, is it possible to group the ENVs together based on matching string? 

Multiple Envs:

index=_* OR index=* sourcetype=autosys_vm1_event_demon AND (JobName=DWP_VME_DLACS_*_START_COMP_0 Status=RUNNING) OR (JobName=DWP_VME_DLACS_*_OSMPCONTROL_0 Status=SUCCESS)
| transaction maxevents=2
| table JobName duration _time

I have attached two screenshots, one of a single env which gives me my desired output and one where I stick a * in the search and how the search is grouping multiple events.

Multiple: 

multiplemultiple

Single working:

working singleworking single

TIA, Cameron. 

 

Labels (3)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

when You are using transaction You should use  startswith and endswith parameters to match start and end correctly. Also you should use some field which match those to correct job.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...