Splunk Search

Using transaction command to group jobs together based on different Statuses.Multiple startwith and endswith transaction

tarunmalhotra79
Engager

Ideally, JOB should start with Status as either RUNNING or STARTJOB or maybe both and it can end with either status as Termination, failure, Inactive, or success.
Examples:
[11/27/2021 08:00:00] TEST EVENT: STARTJOB JOB: A
[11/27/2021 08:00:05] TEST EVENT: CHANGE_STATUS STATUS: RUNNING JOB: A
[11/27/2021 08:06:23] TEST EVENT: CHANGE_STATUS STATUS: SUCCESS JOB: A

[11/28/2021 08:00:00] TEST EVENT: STARTJOB JOB: A
[11/28/2021 08:00:05] TEST EVENT: CHANGE_STATUS STATUS: RUNNING JOB: A
[11/28/2021 08:00:05] TEST EVENT: CHANGE_STATUS STATUS: FAILURE JOB: A
[11/28/2021 09:06:23] TEST EVENT: CHANGE_STATUS STATUS: SUCCESS JOB: A

[11/26/2021 08:00:05] TEST EVENT: CHANGE_STATUS STATUS: RUNNING JOB: B
[11/26/2021 20:06:23] TEST EVENT: CHANGE_STATUS STATUS: FAILURE JOB: B

[11/25/2021 08:00:00] TEST EVENT: STARTJOB JOB: C
[11/25/2021 20:06:23] TEST EVENT: CHANGE_STATUS STATUS: INACTIVE JOB: C


I have more than 1400 jobs, some are running daily, some monthly, and some quarterly.
In this scenario, Ultimately I am looking to calculate the last 90 days' average of duration (job end time - job start time) but somehow events are not getting properly grouped.

 

Below is the query currently I am using:- 

Example 1

| eval end=case(_raw LIKE "%INACTIVE%","FAIL", _raw LIKE "%TERMINAT%","FAIL", _raw LIKE "%FAILURE%","FAIL" ,_raw LIKE "%SUCCESS%","FAIL",true(),"NA")
| reverse
| sort - _time limit=0
| transaction JOB startswith="*STARTJOB* AND *RUNNING*" endswith="end="FAIL"" keeporphans=true maxevents=9999999 keepevicted=true

Example 2

| transaction JOB startswith=(STATUS="RUNNING" OR STATUS="STARTJOB") endswith=(*TERMINATED*) OR (*FAILURE*) OR (*INACTIVE*) OR (*SUCCESS*) keeporphans=true maxevents=9999999 keepevicted=true

Any help would be highly appreciated.

Thanks in advance.

 

Labels (2)
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>