Hi All.
I need help with Splunk Query for below scenario:
I need to show the status of my cronjob in below format.
Starttime | FinishTIme | CurrentStatus |
Time when Job Starts | Time when Job Finishes | Started/Running/Finished |
Start:-
INFO | jvm 1 | main | 2020/07/16 03:30:08.407 xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Found 13 set of files to process
End:-
INFO | jvm 1 | main | 2020/07/16 04:21:57.914 xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Ended . RESULT :true
In between there are many lines for which status should be running..
Thanks in dvance
Hi
This works with one batch, if there are more, then you need to update that query.
| makeresults
| eval _raw="INFO | jvm 1 | main | 2020/07/16 03:30:08.407 xxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Found 13 set of files to process
INFO | jvm 1 | main | 2020/07/16 04:21:57.914 xxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Satus . RESULT :true
INFO | jvm 1 | main | 2020/07/16 04:21:57.914 xxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Ended . RESULT :true"
| multikv noheader=t
| eval jvm=Column_3, step=Column_6
| rex "Ended\s+\.\s+RESULT\s+:(?<result>\w+)"
| rex "Found\s+(?<noFiles>\d+) set of files to process"
| stats earliest(_time) as Starttime latest(_time) as FinishTime count as noStatus values(result) as result values(noFiles) as noFiles by jvm step
| eval CurrentStatus = case(isnotnull(result), "Finished", noStatus > 1, "Running", isnotnull(noFiles), "Started", true(), "Unkown status")
| eval Starttime = strftime(Starttime, "%c"), FinishTime = strftime(FinishTime, "%c")
| table Starttime FinishTime CurrentStatus
Hi
is the “jvm 1” and “main” same for all steps in one job? How you can separate the another jobs on log files/events?
r. Ismo
Yes , its same for all the the events.
I am using the common string in the search query for the job for which I want to print the below message.
Hi
This works with one batch, if there are more, then you need to update that query.
| makeresults
| eval _raw="INFO | jvm 1 | main | 2020/07/16 03:30:08.407 xxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Found 13 set of files to process
INFO | jvm 1 | main | 2020/07/16 04:21:57.914 xxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Satus . RESULT :true
INFO | jvm 1 | main | 2020/07/16 04:21:57.914 xxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Ended . RESULT :true"
| multikv noheader=t
| eval jvm=Column_3, step=Column_6
| rex "Ended\s+\.\s+RESULT\s+:(?<result>\w+)"
| rex "Found\s+(?<noFiles>\d+) set of files to process"
| stats earliest(_time) as Starttime latest(_time) as FinishTime count as noStatus values(result) as result values(noFiles) as noFiles by jvm step
| eval CurrentStatus = case(isnotnull(result), "Finished", noStatus > 1, "Running", isnotnull(noFiles), "Started", true(), "Unkown status")
| eval Starttime = strftime(Starttime, "%c"), FinishTime = strftime(FinishTime, "%c")
| table Starttime FinishTime CurrentStatus
Thanks a ton.
It worked like a gem.
I am able to create Splunk query based on you suggestion.
Thanks again