Hi I think we are close, and thanks for your efforts. A couple of points This is only a problem for | search resourceSpans{}.scopeSpans{}.spans{}.attributes{}.value.stringValue = "$Token_Mr_jobId$...
See more...
Hi I think we are close, and thanks for your efforts. A couple of points This is only a problem for | search resourceSpans{}.scopeSpans{}.spans{}.attributes{}.value.stringValue = "$Token_Mr_jobId$". This is the token that I am looking at. Token_Mr_jobId - Can be a dynamic list, so more than the 2 I gave in the example. So the question is, how to pass the dynamic selection? <input type="dropdown" token="Token_Mr_jobId">
<label>JobId</label>
<fieldForLabel>mr_jobId</fieldForLabel>
<fieldForValue>mr_jobId</fieldForValue>
<search>
<query>host="$Host_Token$" index="murex_logs" sourcetype="Market_Risk_DT" "**mr_strategy**"
"resourceSpans{}.resource.attributes{}.value.stringValue"="$TOKEN_Service_Namespace$"
| fields - resourceSpans{}.*
| spath path=resourceSpans{}
| mvexpand resourceSpans{}
| spath input=resourceSpans{} path=scopeSpans{}
| fields - resourceSpans{}
| mvexpand scopeSpans{}
| spath input=scopeSpans{} path=spans{}
| fields - scopeSpans{}
| mvexpand spans{}
| where match('spans{}', "mr_batchId")
| spath input=spans{} path=attributes{} output=attributes
| foreach mr_batchId mr_jobId
[ eval <<FIELD>> = mvappend(<<FIELD>>, mvmap(attributes, if(spath(attributes, "key") != "<<FIELD>>", null(), spath(attributes, "value")))),
<<FIELD>> = coalesce(spath(<<FIELD>>, "doubleValue"), spath(<<FIELD>>, "stringValue"))]
| dedup _time mr_batchId
``` the above is key logic. If there is any doubt, you can also use
| dedup _time mr_batchId mr_batch_compute_cpu_time mr_batch_compute_time
```
| table _time mr_batchId mr_batch_compute_cpu_time mr_batch_compute_time mr_batch_load_cpu_time mr_batch_load_time mr_strategy mr_jobId
| table mr_jobId
| dedup mr_jobId</query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
</search>
<change>
<condition match="$Token_Mr_jobId$ != "*"">
<set token="TOKEN_Strategy">ON</set>
<set token="TOKEN_TRACEID">*</set>
</condition>
<condition match="$Token_Mr_jobId$ = "*"">
<unset token="TOKEN_Strategy"></unset>
<set token="TOKEN_TRACEID">*</set>
</condition>
<condition>
<set token="TOKEN_TRACEID">*</set>
</condition>
</change>
<choice value="*">*</choice>
<default>*</default>
</input> Also, to add - Here are 2 data sets. 1 with resourceSpans{}.scopeSpans{}.spans{}.attributes{}.value.stringValue and one with out. With | search resourceSpans{}.scopeSpans{}.spans{}.attributes{}.value.stringValue = "CONSO_ABAQ | 31/03/2016 | 21" {"resourceSpans":[{"resource":{"attributes":[{"key":"telemetry.sdk.language","value":{"stringValue":"cpp"}},{"key":"service.name","value":{"stringValue":"MXMARKETRISK.ENGINE.MX"}},{"key":"service.namespace","value":{"stringValue":"MXMARKETRISK.SERVICE"}},{"key":"process.pid","value":{"intValue":"604252"}},{"key":"service.instance.id","value":{"stringValue":"003nhhkz"}},{"key":"telemetry.sdk.name","value":{"stringValue":"opentelemetry"}},{"key":"telemetry.sdk.version","value":{"stringValue":"1.12.0"}},{"key":"mx.env","value":{"stringValue":"dell945srv:13003"}}]},"scopeSpans":[{"scope":{"name":"murex::observability_otel_backend::tracing","version":"v1"},"spans":[{"traceId":"10731f4b1d19380ceb33ae33672dbd5f","spanId":"0392a58e2dfaaa4c","parentSpanId":"ebce3b37999c2ea1","name":"scenario_reaction","kind":1,"startTimeUnixNano":"1747148775503846985","endTimeUnixNano":"1747148782361058175","attributes":[{"key":"market_risk_span","value":{"stringValue":"true"}}],"status":{}},{"traceId":"10731f4b1d19380ceb33ae33672dbd5f","spanId":"ebce3b37999c2ea1","parentSpanId":"825cbaedeb509365","name":"scenario_apply","kind":1,"startTimeUnixNano":"1747148775477950524","endTimeUnixNano":"1747148782362084106","attributes":[{"key":"market_risk_span","value":{"stringValue":"true"}},{"key":"mr_scenario","value":{"stringValue":"10"}}],"status":{}},{"traceId":"10731f4b1d19380ceb33ae33672dbd5f","spanId":"04307bd9c64e20e8","parentSpanId":"825cbaedeb509365","name":"structured_position_evaluation","kind":1,"startTimeUnixNano":"1747148782362177082","endTimeUnixNano":"1747148782379867824","attributes":[{"key":"market_risk_span","value":{"stringValue":"true"}},{"key":"mr_scenario","value":{"stringValue":"10"}}],"status":{}},{"traceId":"10731f4b1d19380ceb33ae33672dbd5f","spanId":"d2abbf63ac87acb4","parentSpanId":"825cbaedeb509365","name":"position_evaluation","kind":1,"startTimeUnixNano":"1747148782380422079","endTimeUnixNano":"1747148782509071609","attributes":[{"key":"market_risk_span","value":{"stringValue":"true"}},{"key":"mr_scenario","value":{"stringValue":"10"}}],"status":{}},{"traceId":"10731f4b1d19380ceb33ae33672dbd5f","spanId":"cc80374715a2e755","parentSpanId":"431a2a6341ac4120","name":"scenario_reaction","kind":1,"startTimeUnixNano":"1747148782510724546","endTimeUnixNano":"1747148782599301641","attributes":[{"key":"market_risk_span","value":{"stringValue":"true"}}],"status":{}},{"traceId":"10731f4b1d19380ceb33ae33672dbd5f","spanId":"431a2a6341ac4120","parentSpanId":"825cbaedeb509365","name":"scenario_restore","kind":1,"startTimeUnixNano":"1747148782509167483","endTimeUnixNano":"1747148782605479850","attributes":[{"key":"market_risk_span","value":{"stringValue":"true"}},{"key":"mr_scenario","value":{"stringValue":"10"}}],"status":{}},{"traceId":"10731f4b1d19380ceb33ae33672dbd5f","spanId":"825cbaedeb509365","parentSpanId":"8e2a92d0a40f203b","name":"scenario_all_apply","kind":1,"startTimeUnixNano":"1747148711449995255","endTimeUnixNano":"1747148782623591981","attributes":[{"key":"market_risk_span","value":{"stringValue":"true"}},{"key":"mr_scenario_nb","value":{"stringValue":"10"}}],"status":{}},{"traceId":"10731f4b1d19380ceb33ae33672dbd5f","spanId":"8e2a92d0a40f203b","parentSpanId":"8e5190bbe86bdaff","name":"fullreval_task","kind":1,"startTimeUnixNano":"1747148638253233246","endTimeUnixNano":"1747148782639890403","attributes":[{"key":"market_risk_span","value":{"stringValue":"true"}},{"key":"mr_batchId","value":{"stringValue":"40"}},{"key":"mr_batchType","value":{"stringValue":"Full Revaluation"}},{"key":"mr_bucketName","value":{"stringValue":""}},{"key":"mr_jobDomain","value":{"stringValue":"Market Risk"}},{"key":"mr_jobId","value":{"stringValue":"CONSO_ABAQ | 31/03/2016 | 21"}},{"key":"mr_strategy","value":{"stringValue":"typo_Callable Bond"}},{"key":"mr_uuid","value":{"stringValue":"7dcdf03d-9dd0-42f6-b0f4-e2508283ff44"}},{"key":"mrb_batch_affinity","value":{"stringValue":"CONSO_ABAQ_run_Batch|CONSO_ABAQ|2016/03/31|21_FullReval0_00040"}},{"key":"mr_batch_compute_cpu_time","value":{"doubleValue":71.000477}},{"key":"mr_batch_compute_time","value":{"doubleValue":71.351}},{"key":"mr_batch_load_cpu_time","value":{"doubleValue":61.569109000000005}},{"key":"mr_batch_load_time","value":{"doubleValue":71.597}},{"key":"mr_batch_status","value":{"stringValue":"WARNING"}},{"key":"mr_batch_total_cpu_time","value":{"doubleValue":133.924506}},{"key":"mr_batch_total_time","value":{"doubleValue":144.375}}],"status":{}}]}]}]} With | search resourceSpans{}.scopeSpans{}.spans{}.attributes{}.value.stringValue = * (But I understand your great idea, that we will just put in "|search *") {"resourceSpans":[{"resource":{"attributes":[{"key":"process.pid","value":{"intValue":"600146"}},{"key":"service.instance.id","value":{"stringValue":"003nhhk3"}},{"key":"service.name","value":{"stringValue":"LAUNCHERMXMARKETRISK_MPC"}},{"key":"service.namespace","value":{"stringValue":"LAUNCHER"}},{"key":"telemetry.sdk.language","value":{"stringValue":"java"}},{"key":"telemetry.sdk.name","value":{"stringValue":"opentelemetry"}},{"key":"telemetry.sdk.version","value":{"stringValue":"1.34.0"}},{"key":"mx.env","value":{"stringValue":"dell945srv:13003"}}]},"scopeSpans":[{"scope":{"name":"mx-traces-api","version":"1.0.0"},"spans":[{"traceId":"10731f4b1d19380ceb33ae33672dbd5f","spanId":"cbf88ed07b403b48","parentSpanId":"3cfc7d85786b676b","name":"createSubmission","kind":1,"startTimeUnixNano":"1747152946314481406","endTimeUnixNano":"1747152946314775297","status":{}},{"traceId":"10731f4b1d19380ceb33ae33672dbd5f","spanId":"8ff7fabcab4b12d0","parentSpanId":"3cfc7d85786b676b","name":"createSubmission","kind":1,"startTimeUnixNano":"1747152946353054099","endTimeUnixNano":"1747152946353187644","status":{}},{"traceId":"10731f4b1d19380ceb33ae33672dbd5f","spanId":"4b14e49df1e1ffd8","parentSpanId":"3cfc7d85786b676b","name":"createSubmission","kind":1,"startTimeUnixNano":"1747152946474942393","endTimeUnixNano":"1747152946475042609","status":{}},{"traceId":"10731f4b1d19380ceb33ae33672dbd5f","spanId":"169b89bf118931d8","parentSpanId":"3cfc7d85786b676b","name":"createSubmission","kind":1,"startTimeUnixNano":"1747152946488875310","endTimeUnixNano":"1747152946488933120","status":{}}]}]}]}