We have a job which is getting terminated intermittently , even though when this search gets executed successfully it's run time is just 7-8 mins. Still it fails sometimes. Can someone suggest how we can avoid its failure:
(index=200004664_triumph_sidx sourcetype=tr_billed_summary_sidx (indc_wve_fnchg_sdx="N") (player_acct_nbr_sdx=100269999 OR player_acct_nbr_sdx=100269984 OR player_acct_nbr_sdx=100269963 OR player_acct_nbr_sdx=100269976 OR player_acct_nbr_sdx=100269950) (code_ia_prod_id_sdx!="KOB" AND code_ia_prod_id_sdx!="KOC" AND code_ia_prod_id_sdx!="KOD" AND code_ia_prod_id_sdx!="KOE" AND code_ia_prod_id_sdx!="KOF") earliest=-45d@d latest=-1d@d)
| fields - _raw
| fields nbr_plst_sdx code_trans_acct_sdx indc_cyc_rvlv_sdx amt_curr_outst_bal_sdx indc_wve_fnchg_sdx player_acct_nbr_sdx code_ia_prod_id_sdx
| eval date_prev=strftime(_time,"%m/%d/%Y")
| fillnull value="NULL" code_trans_acct_sdx indc_cyc_rvlv_sdx
| where code_trans_acct_sdx="NULL"
| rename indc_cyc_rvlv_sdx as indc_cyc_rvlv_prev amt_curr_outst_bal_sdx as amt_curr_outst_bal_prev
| JOIN nbr_plst_sdx
[ search
(index=200004664_triumph_sidx sourcetype=tr_billed_summary_sidx (indc_wve_fnchg_sdx="N") (player_acct_nbr_sdx=100269999 OR player_acct_nbr_sdx=100269984 OR player_acct_nbr_sdx=100269963 OR player_acct_nbr_sdx=100269976 OR player_acct_nbr_sdx=100269950) earliest=-1d@d latest=@d)
| fields - _raw
| fields nbr_plst_sdx code_trans_acct_sdx indc_cyc_rvlv_sdx amt_curr_outst_bal_sdx indc_wve_fnchg_sdx player_acct_nbr_sdx code_ia_prod_id_sdx
| eval date_current=strftime(_time,"%m/%d/%Y")
| fillnull value="NULL" code_trans_acct_sdx indc_cyc_rvlv_sdx
| where code_trans_acct_sdx="NULL" and amt_curr_outst_bal_sdx > 0
| rename indc_cyc_rvlv_sdx as indc_cyc_rvlv_current amt_curr_outst_bal_sdx as amt_curr_outst_bal_current]
| stats values(date_current) as date_current values(indc_cyc_rvlv_current) as indc_cyc_rvlv_current values(amt_curr_outst_bal_current) as amt_curr_outst_bal_current latest(date_prev) as date_prev latest(indc_cyc_rvlv_prev) as indc_cyc_rvlv_prev latest(amt_curr_outst_bal_prev) as amt_curr_outst_bal_prev values(player_acct_nbr_sdx) as player_acct_nbr values(indc_wve_fnchg_sdx) as indc_wve_fnchg values(code_ia_prod_id_sdx) as code_ia_prod_id by nbr_plst_sdx
| eval check_type=case((indc_cyc_rvlv_prev="N" AND indc_cyc_rvlv_current="N"),"T2T", (indc_cyc_rvlv_prev="Y" AND indc_cyc_rvlv_current="Y"),"R2R", (indc_cyc_rvlv_prev="N" AND indc_cyc_rvlv_current="Y"),"T2R",1=1,"NA")
| rename nbr_plst_sdx as nbr_plst
| where check_type != "NA"
| table nbr_plst player_acct_nbr code_ia_prod_id indc_wve_fnchg date_prev indc_cyc_rvlv_prev amt_curr_outst_bal_prev date_current indc_cyc_rvlv_current amt_curr_outst_bal_current check_type
| eval date_curr_epoch=strptime(date_current,"%m/%d/%Y")
| eval date_prev_epoch=strptime(date_prev,"%m/%d/%Y")
| eval date_diff=(date_curr_epoch-date_prev_epoch)/86400
| eval date_diff=round(date_diff)
| JOIN nbr_plst
[ search
index=triumph sourcetype=tr_billed_subbalance (nbr_plyr_acct=100269999 OR nbr_plyr_acct=100269984 OR nbr_plyr_acct=10026963 OR nbr_plyr_acct=100269976 OR nbr_plyr_acct=100269950) (code_prch_cadv="P") earliest=-1d@d latest=@d
| stats values(amt_ctd_fc) as amt_ctd_fc values(amt_adb) as amt_adb values(beg_dpr) as beg_dpr values(pct_stmt_dpr) as pct_stmt_dpr values(code_be_grace) as code_be_grace values(code_fe_grace) as code_fe_grace by nbr_plst prty_l2h]
| eval amt_adb = tonumber(amt_adb)
| eval amt_ctd_fc = tonumber(amt_ctd_fc)
| eval beg_dpr = tonumber(beg_dpr)
| eval pct_stmt_dpr = tonumber(pct_stmt_dpr)
| eval calc_fc=exact((amt_adb*pct_stmt_dpr*date_diff)/100)
| eval calc_fc_round=round(calc_fc,2)
| rex field=calc_fc "(?P<calc_fc>[0-9]*[.][0-9]{2})\d*"
| table * amt_ctd_fc amt_adb pct_stmt_dpr date_diff calc_fc calc_fc_round
| eval valid_type=case((check_type="T2T" AND amt_ctd_fc>0),"alert1",
(check_type="R2R" AND (amt_adb>0 AND amt_ctd_fc=0)),"alert2",
(check_type="R2R" AND (pct_stmt_dpr>0 AND amt_ctd_fc=0)),"alert3",
(check_type="R2R" AND (amt_adb>0 AND amt_ctd_fc!=calc_fc_round)),"alert4",
(check_type="R2R" AND (pct_stmt_dpr>0 AND amt_ctd_fc!=calc_fc_round)),"alert5",
(check_type="T2R" AND (amt_adb>0 AND amt_ctd_fc=0)),"alert6",
(check_type="T2R" AND (pct_stmt_dpr>0 AND amt_ctd_fc=0)),"alert7",
(check_type="T2R" AND (amt_adb>0 AND amt_ctd_fc!=calc_fc_round)),"alert8",
(check_type="T2R" AND (pct_stmt_dpr>0 AND amt_ctd_fc!=calc_fc_round)),"alert9",1=1,"NA")
| table * valid_type
| where valid_type="alert1" OR valid_type="alert2" OR valid_type="alert3" OR valid_type="alert4" OR valid_type="alert5" OR valid_type="alert6" OR valid_type="alert7" OR valid_type="alert8" OR valid_type="alert9"
| where calc_fc_round > 0
| fields - amt_curr_outst_bal_prev beg_dpr date_curr_epoch date_prev_epoch
| where (check_type!="T2T" AND code_fe_grace!=02)
| eval calc_fc_low = round(calc_fc-0.01,2)
| eval calc_fc_high = round(calc_fc+0.01,2)
| where (amt_ctd_fc > calc_fc_high) OR (amt_ctd_fc < calc_fc_low)
| rename amt_adb as "Average Daily Balance Amt" pct_stmt_dpr as "Statement DPR Percentage" amt_ctd_fc as "FC Assessed by Triumph" calc_fc_round as "Calculated FC" nbr_plst as "Plastic Number" amt_curr_outst_bal_current as "Current Outstanding Balance"
| eval epochyesterday=relative_time(now(),"-1d@d")
| eval yesterday=strftime(epochyesterday,"%m%d%y")
| eval Splunk_Alert_Id="iFIND Pricing and Fees"."||"."Grace_Monitoring"."_".yesterday
| fields - date_current date_diff date_prev epochyesterday yesterday valid_type
