Splunk Search

Splunk Query

pratapa
Explorer

The Splunk report below returns ‘shipping points’ (warehouse codes). Using the lookup table (also below), our job is to sent relevant Splunk results for a shipping point, to the appropriate warehouse group defined in the lookup table.

SPLUNK QUERY

index=webmethods_nonprd CESAP.pub.Shipment.handler:processShipment_PostalMailProvider OR CEAustraliaPost.sub.Shipment.handler | transaction shipment | search NOT (linecount="3" AND "Published shipment document" AND "Successfully created Australia Post shipment order" "Generated Australia Post shipment order summary and archived it in the SAP content repository") | fields shipment, point, delivery

LOOKUP TABLE

Shipping Point (Warehouse Code) Alert Email of Warehouse Group

2000 distenqdesk@xyz.com

3000 distenqdeskvic@xyz.com

4000 distenqdesksouthqld@xyz.com

6000 distenqdeskwa@xyz.com

7020 distenqdesktas@xyz.com

8000 distenqdeskNT@xyz.com

The Splunk report below returns ‘shipping points’ (warehouse codes). Using the lookup table (also below), our job is to sent relevant Splunk results for a shipping point, to the appropriate warehouse group defined in the lookup table.

Could you please advise the ‘right’ way to do this? (e.g., using Splunk lookup table functionality).

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Analytics Workspace deprecation

As of Splunk Cloud Platform 10.4.2604 and Splunk Enterprise 10.4, Analytics Workspace is now deprecated. ...

Splunk Developer Day Recap: Building, Publishing, and Growing on the Splunk Platform

Splunk Developer Day brought the Splunk developer community together for a practical look at what it means to ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...