Need help with Splunk Query

[nilbak1]

Hi All.

I need help with Splunk Query for below scenario:

I need to show the status of my cronjob in below format.

Starttime	FinishTIme	CurrentStatus
Time when Job Starts	Time when Job Finishes	Started/Running/Finished

Start:-
INFO | jvm 1 | main | 2020/07/16 03:30:08.407 xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Found 13 set of files to process

End:-
INFO | jvm 1 | main | 2020/07/16 04:21:57.914 xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Ended . RESULT :true

In between there are many lines for which status should be running..

Thanks in dvance

[isoutamo]

Hi

is the “jvm 1” and “main” same for all steps in one job? How you can separate the another jobs on log files/events?

r. Ismo

[nilbak1]

Yes , its same for all the the events.
I am using the common string in the search query for the job for which I want to print the below message.

[isoutamo · Accepted solution]

Hi

This works with one batch, if there are more, then you need to update that query.

| makeresults
| eval _raw="INFO | jvm 1 | main | 2020/07/16 03:30:08.407 xxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Found 13 set of files to process
INFO | jvm 1 | main | 2020/07/16 04:21:57.914 xxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Satus . RESULT :true
INFO | jvm 1 | main | 2020/07/16 04:21:57.914 xxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Ended . RESULT :true"
| multikv noheader=t
| eval jvm=Column_3, step=Column_6
| rex "Ended\s+\.\s+RESULT\s+:(?<result>\w+)"
| rex "Found\s+(?<noFiles>\d+) set of files to process"
| stats earliest(_time) as Starttime latest(_time) as FinishTime count as noStatus values(result) as result values(noFiles) as noFiles by jvm step
| eval CurrentStatus = case(isnotnull(result), "Finished", noStatus > 1, "Running", isnotnull(noFiles), "Started", true(), "Unkown status")
| eval Starttime = strftime(Starttime, "%c"), FinishTime = strftime(FinishTime, "%c")
| table Starttime FinishTime CurrentStatus

[nilbak1]

Thanks a ton.
It worked like a gem.

I am able to create Splunk query based on you suggestion.
Thanks again