My actually event look like below. And I am searching on last 24 Hours events.
When I am using below query
index = cba_hcck8s_UHGWM110-013948 host=prod_poc source=poc| spath | eval message="...
See more...
My actually event look like below. And I am searching on last 24 Hours events.
When I am using below query
index = cba_hcck8s_UHGWM110-013948 host=prod_poc source=poc| spath | eval message="{\"message\":".message."}" | spath input=message message{} output=collection | mvexpand collection | spath input=collection |eval totalCount = SKIPPED + PROCESSED|chart sum(totalCount) as TotalClaims by DAYHOUR DATE
its not giving me below given events if I am removing the spath then its start matching below events only and rest of the events not matching. not sure why its behaving like this.
index = cba_hcck8s_UHGWM110-013948 host=prod_poc source=poc| spath | eval message="{\"message\":".message."}" | spath input=message message{} output=collection | mvexpand collection | spath input=collection |eval totalCount = SKIPPED + PROCESSED|chart sum(totalCount) as TotalClaims by DAYHOUR DATE
Event-
[{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00031AdjPro","TOTAL":0,"PROCESSED":1,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00031AdjPro","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":2118,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00035","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":1,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00035Med","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":1,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00052Med","TOTAL":0,"PROCESSED":2898,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00052Med","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":3,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00075","TOTAL":0,"PROCESSED":94,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00075","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":2,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00075","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":59,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00119","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":3,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00201H","TOTAL":0,"PROCESSED":1,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00243","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":1,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00243","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":1,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00283H","TOTAL":0,"PROCESSED":7,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00283H","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":104,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00302","TOTAL":0,"PROCESSED":1395,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00302","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":5,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00304","TOTAL":0,"PROCESSED":299,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00304","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":16,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00310","TOTAL":0,"PROCESSED":2,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00365","TOTAL":0,"PROCESSED":588,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00365","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":619,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00479H","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":4,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00479H","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":1,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00607Bundle","TOTAL":0,"PROCESSED":1,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00646","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":1,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00646","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":2,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00681","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":1,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00721H","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":1,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_02071","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":2,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_02229","TOTAL":0,"PROCESSED":1,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_02278","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":1,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_HOSPICE_CLM","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":1,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15}]
Event-
[{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00011H","TOTAL":0,"PROCESSED":1,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":16},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00011H","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":35,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":16},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00061","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":1,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":16},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_HOSPICE","TOTAL":0,"PROCESSED":27,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":16},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_HOSPICE","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":60,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":16},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_HOSPICE_CLM","TOTAL":0,"PROCESSED":1240,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":16},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_HOSPICE_CLM","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":14,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":16}]