All Posts

Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.

All Posts

Hi @Tafadzwa  I'm pleased to be of help. Please consider marking my previous post as the accepted answer and adding Karma so other users finding this issue can see the solution. Thanks
Hi @kevinj  This app is managed by Akamai - you would need to reach out to their support team via support@akamai.com to request this as they may not be monitoring this forum.  Did this answer hel... See more...
Hi @kevinj  This app is managed by Akamai - you would need to reach out to their support team via support@akamai.com to request this as they may not be monitoring this forum.  Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing
Hi @koshyk  I did a PoC with a customer around this a few months ago and we had great success using the regular saved/search endpoint to create searches from a custom app created with contentctl.  ... See more...
Hi @koshyk  I did a PoC with a customer around this a few months ago and we had great success using the regular saved/search endpoint to create searches from a custom app created with contentctl.  We used a custom app which we uploaded the searches into, this way we are following the same pattern as creating a custom app from contentctl which would be uploaded.  ES rules are essentially scheduled searches, with modular alerts, they just show in ES because of some of the settings in them, from memory these might be action.correlationsearch.* and action.notable.param.* settings.  I think the main gotcha that caught is out is that in the savedsearches.conf we use "enabledSched = 1" to schedule a search, however the API expects "is_scheduled =1" (WHY?!?) Check my response below to the following post which has a sample python code to upload a savedsearch if it helps - https://community.splunk.com/t5/All-Apps-and-Add-ons/Custom-app-in-cloud/m-p/745079 @livehybrid wrote: Hi @hazardoom  If you arent wanting to go down the app route then another thing you could look at it is using the REST API.  Ive used this with clients in the past, here is an example to get your started if this is something you wanted to explore: import configparser import requests from urllib.parse import quote # ======= USER CONFIGURATION ========= SPLUNK_HOST = 'https://yoursplunkhost:8089' # e.g., https://localhost:8089 SPLUNK_TOKEN = 'your-token-here' # just the token string, no 'Splunk ' prefix APP = 'search' # target app for the saved searches CONF_FILE = 'savedsearches.conf' # path to your savedsearches.conf file VERIFY_SSL = True # set to False if using self-signed certs USERNAME = 'yourUsername' # API requires this as a path component # ==================================== # Map conf fields to REST API fields def convert_field_name(field, value): """Map .conf fields to API fields and perform value translations.""" if field == "enableSched": return "is_scheduled", "1" if value.strip().lower() in ("1", "true", "yes", "on") else "0" return field, value def load_savedsearches(conf_path): cp = configparser.ConfigParser(strict=False, delimiters=['=']) cp.optionxform = str # preserve case and case sensitivity cp.read(conf_path) return cp def upload_savedsearches(cp): headers = {'Authorization': f'Splunk {SPLUNK_TOKEN}'} base_url = f"{SPLUNK_HOST}/servicesNS/{USERNAME}/{APP}/saved/searches" for savedsearch_name in cp.sections(): data = {'name': savedsearch_name} for field, value in cp[savedsearch_name].items(): api_field, api_value = convert_field_name(field, value) data[api_field] = api_value search_url = f"{base_url}/{quote(savedsearch_name)}" # Check if the saved search exists (GET request) check = requests.get(search_url, headers=headers, verify=VERIFY_SSL) if check.status_code == 200: print(f"Updating existing savedsearch: {savedsearch_name}") r = requests.post(search_url, data=data, headers=headers, verify=VERIFY_SSL) else: print(f"Creating new savedsearch: {savedsearch_name}") r = requests.post(base_url, data=data, headers=headers, verify=VERIFY_SSL) if r.status_code not in (200, 201): print(f"Failed for {savedsearch_name}: {r.status_code} {r.text}") else: print(f"Success: {savedsearch_name}") def main(): cp = load_savedsearches(CONF_FILE) upload_savedsearches(cp) if __name__ == "__main__": main() We use this approach to upload file direct from Git pipelines which is especially useful if you arent an admin on the platform so cannot upload an app - however may also work well for your usecase. Note: you could use the Splunk Python SDK too, which basically does the same thing.  Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing    
Hi @robertlynch2020  I think the following might work?   Full SPL with sample data below: | windbag | head 1 | eval _raw="{\"resourceSpans\":[{\"resource\":{\"attributes\":[{\"key\":\"servi... See more...
Hi @robertlynch2020  I think the following might work?   Full SPL with sample data below: | windbag | head 1 | eval _raw="{\"resourceSpans\":[{\"resource\":{\"attributes\":[{\"key\":\"service.name\",\"value\":{\"stringValue\":\"trade-blotter\"}},{\"key\":\"service.namespace\",\"value\":{\"stringValue\":\"trade-blotter-public\"}}]},\"scopeSpans\":[{\"spans\":[{\"traceId\":\"61df555eabf3b66cd8933809f00e409f\",\"spanId\":\"abc123\",\"name\":\"referenceDataBuildClient\",\"startTimeUnixNano\":\"1746628424928265438\",\"endTimeUnixNano\":\"1746628424928267680\"},{\"traceId\":\"61df555eabf3b66cd8933809f00e409f\",\"spanId\":\"def456\",\"name\":\"readLiveQuery\",\"startTimeUnixNano\":\"1746628424928290524\",\"endTimeUnixNano\":\"1746628424928301728\"}]}]}]}" | spath resourceSpans{}.resource.attributes{} output=resourceAttributes | eval service_name=mvfilter(match(resourceAttributes,".*service.name\"")) | eval service_namespace=mvfilter(match(resourceAttributes,".*service.namespace")) | foreach service_name* [| eval <<FIELD>>=json_extract(json_extract(<<FIELD>>,"value"),"stringValue") ] | spath resourceSpans{}.scopeSpans{}.spans{} output=scopeSpans | stats count by scopeSpans | spath input=scopeSpans | rename startTimeUnixNano as start | rename endTimeUnixNano as end | eval _time=start/pow(10,9) | eval duration = end -start | eval duration= duration/1000000 | eval duration = round(duration,0) | eval parentSpanId =if(parentSpanId="" ,"0", $parentSpanId$) | rename name as SPAN_TYPE | search traceId = 61df555eabf3b66cd8933809f00e409f | table _time SPAN_TYPE spanId duration | sort _time  Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing
Hi I have a difficult one - I am unsure if it is possible. I have large JSON data - Distributed traces.  I can extract the data I need by doing 2 separate SPL - but I need to join them now, I am u... See more...
Hi I have a difficult one - I am unsure if it is possible. I have large JSON data - Distributed traces.  I can extract the data I need by doing 2 separate SPL - but I need to join them now, I am unsure if it is possible! SPL 1  host="Tick_Blotter" index="murex_logs" sourcetype="Market_Risk_DT" | search "resourceSpans{}.resource.attributes{}.value.stringValue"="*" | spath resourceSpans{}.scopeSpans{}.spans{} output=scopeSpans | stats count by scopeSpans | spath input=scopeSpans | rename startTimeUnixNano as start | rename endTimeUnixNano as end | eval _time=start/pow(10,9) | eval duration = end -start | eval duration= duration/1000000 | eval duration = round(duration,0) | eval parentSpanId =if(parentSpanId="" ,"0", $parentSpanId$) | rename name as SPAN_TYPE | search traceId = 61df555eabf3b66cd8933809f00e409f | table _time SPAN_TYPE spanId duration | sort _time This produces below, however, I don't want SpanID anymore - I need something in the second SPL, service.namespace.  I need _time SPANTYPE service.namespace duration   Below is the second SPL - This allows me to see 1 service.namespace per event. host=Tick_blotter index="murex_logs" sourcetype="Market_Risk_DT" 61df555eabf3b66cd8933809f00e409f | spath resourceSpans{}.resource{}.attributes{} output=scopeSpans | stats count by scopeSpans _time | spath input=scopeSpans | eval X_{key}=coalesce('value.doubleValue', 'value.stringValue') | stats values(X_*) as * by _time   The issue is 61df555eabf3b66cd8933809f00e409f is a trace ID, and it over the 2 events. Each event = will only have one service.namespace (So I want to use it). But in the first SPL I don't know how to JOIN/AMMEND it. I am unsure how to access sercive.namespace for each line in the first SPL so I can display it. To add each event only have 1 service.name and can have many SPAN_TYPE   Event: {"resourceSpans":[{"resource":{"attributes":[{"key":"host.name","value":{"stringValue":"dell724srv"}},{"key":"process.executable.name","value":{"stringValue":"java"}},{"key":"process.pid","value":{"intValue":"650298"}},{"key":"service.instance.id","value":{"stringValue":"00kxc0e4"}},{"key":"service.name","value":{"stringValue":"trade-blotter"}},{"key":"service.namespace","value":{"stringValue":"trade-blotter-public"}},{"key":"telemetry.sdk.language","value":{"stringValue":"java"}},{"key":"telemetry.sdk.name","value":{"stringValue":"opentelemetry"}},{"key":"telemetry.sdk.version","value":{"stringValue":"1.34.0"}},{"key":"mx.env","value":{"stringValue":"dell724srv:10011"}}]},"scopeSpans":[{"scope":{"name":"mx-traces-api","version":"1.0.0"},"spans":[{"traceId":"3e7ea1e176f16c59608fa131cc21793d","spanId":"9df98d87b73f8961","parentSpanId":"f8dd62008ede9028","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628420019122069","endTimeUnixNano":"1746628420019123490","status":{}},{"traceId":"3e7ea1e176f16c59608fa131cc21793d","spanId":"d4325d7284f04ecb","parentSpanId":"f8dd62008ede9028","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628420019135588","endTimeUnixNano":"1746628420019148851","status":{}},{"traceId":"3e7ea1e176f16c59608fa131cc21793d","spanId":"1ea153e8b5d27174","parentSpanId":"f8dd62008ede9028","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628420019320912","endTimeUnixNano":"1746628420019322008","status":{}},{"traceId":"3e7ea1e176f16c59608fa131cc21793d","spanId":"eebc3e9c9482b17b","parentSpanId":"b3dd036ff6348169","name":"execute","kind":1,"startTimeUnixNano":"1746628420019612383","endTimeUnixNano":"1746628420029780420","status":{}},{"traceId":"3e7ea1e176f16c59608fa131cc21793d","spanId":"b3dd036ff6348169","parentSpanId":"f8dd62008ede9028","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628420019610081","endTimeUnixNano":"1746628420029782214","status":{}},{"traceId":"3e7ea1e176f16c59608fa131cc21793d","spanId":"b230dae20e6e0491","parentSpanId":"f8dd62008ede9028","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628420029785049","endTimeUnixNano":"1746628420029971805","status":{}},{"traceId":"3e7ea1e176f16c59608fa131cc21793d","spanId":"f8dd62008ede9028","parentSpanId":"","name":"/client-trade-view","kind":1,"startTimeUnixNano":"1746628420019040641","endTimeUnixNano":"1746628420030145345","attributes":[{"key":"size","value":{"intValue":"115"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"0"}}],"status":{}},{"traceId":"54b60b7c6da9a22ba768e8fadf3a3845","spanId":"ef6b58ec87518ee4","parentSpanId":"5d3827ba83adf900","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628420771085428","endTimeUnixNano":"1746628420771087409","status":{}},{"traceId":"54b60b7c6da9a22ba768e8fadf3a3845","spanId":"e13e6973c4f2d8fe","parentSpanId":"5d3827ba83adf900","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628420771099749","endTimeUnixNano":"1746628420771117672","status":{}},{"traceId":"54b60b7c6da9a22ba768e8fadf3a3845","spanId":"e65ca66fb14b14cc","parentSpanId":"5d3827ba83adf900","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628420771311907","endTimeUnixNano":"1746628420771313050","status":{}},{"traceId":"a9b758832f5e732b8098d4c48c57d73f","spanId":"88ccccf728e34dfe","parentSpanId":"e0a1fd2fb002331a","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628420774731478","endTimeUnixNano":"1746628420774732699","status":{}},{"traceId":"a9b758832f5e732b8098d4c48c57d73f","spanId":"1fc10a1382cf8aa7","parentSpanId":"e0a1fd2fb002331a","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628420774738895","endTimeUnixNano":"1746628420774745792","status":{}},{"traceId":"a9b758832f5e732b8098d4c48c57d73f","spanId":"e29fe64846f193ab","parentSpanId":"e0a1fd2fb002331a","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628420774902339","endTimeUnixNano":"1746628420774903483","status":{}},{"traceId":"54b60b7c6da9a22ba768e8fadf3a3845","spanId":"c2ad638af3de778e","parentSpanId":"b122015c9b1f2c26","name":"execute","kind":1,"startTimeUnixNano":"1746628420771668007","endTimeUnixNano":"1746628420782168768","status":{}},{"traceId":"54b60b7c6da9a22ba768e8fadf3a3845","spanId":"b122015c9b1f2c26","parentSpanId":"5d3827ba83adf900","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628420771664771","endTimeUnixNano":"1746628420782171459","status":{}},{"traceId":"54b60b7c6da9a22ba768e8fadf3a3845","spanId":"2a18500faa2fd03e","parentSpanId":"5d3827ba83adf900","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628420782176882","endTimeUnixNano":"1746628420782241838","status":{}},{"traceId":"54b60b7c6da9a22ba768e8fadf3a3845","spanId":"5d3827ba83adf900","parentSpanId":"","name":"/client-trade-view","kind":1,"startTimeUnixNano":"1746628420770967094","endTimeUnixNano":"1746628420782396144","attributes":[{"key":"size","value":{"intValue":"9"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"0"}}],"status":{}},{"traceId":"e583fcc065674216086422d3c9f47f6e","spanId":"7cdbcc4ec423e007","parentSpanId":"1ab3c7611ba27228","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628420855581578","endTimeUnixNano":"1746628420855583532","status":{}},{"traceId":"e583fcc065674216086422d3c9f47f6e","spanId":"8759ab3d4686567b","parentSpanId":"1ab3c7611ba27228","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628420855596031","endTimeUnixNano":"1746628420855614183","status":{}},{"traceId":"e583fcc065674216086422d3c9f47f6e","spanId":"aa961be21c398366","parentSpanId":"1ab3c7611ba27228","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628420855799807","endTimeUnixNano":"1746628420855800958","status":{}},{"traceId":"b8a795b6461c4029683689782ef1c161","spanId":"af0509c2ab7e0872","parentSpanId":"54fa20e32c66829f","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628420887053417","endTimeUnixNano":"1746628420887055789","status":{}},{"traceId":"b8a795b6461c4029683689782ef1c161","spanId":"5e347c16a206a6fe","parentSpanId":"54fa20e32c66829f","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628420887072502","endTimeUnixNano":"1746628420887094093","status":{}},{"traceId":"b8a795b6461c4029683689782ef1c161","spanId":"2aa9e6d64099bf33","parentSpanId":"54fa20e32c66829f","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628420887294568","endTimeUnixNano":"1746628420887295652","status":{}},{"traceId":"b8a795b6461c4029683689782ef1c161","spanId":"372280f0914a6f4f","parentSpanId":"abd092ad18a96505","name":"execute","kind":1,"startTimeUnixNano":"1746628420887711898","endTimeUnixNano":"1746628420900513682","status":{}},{"traceId":"b8a795b6461c4029683689782ef1c161","spanId":"abd092ad18a96505","parentSpanId":"54fa20e32c66829f","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628420887708951","endTimeUnixNano":"1746628420900515614","status":{}},{"traceId":"b8a795b6461c4029683689782ef1c161","spanId":"9c3e7f3b74ea0b36","parentSpanId":"54fa20e32c66829f","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628420900518729","endTimeUnixNano":"1746628420900613330","status":{}},{"traceId":"b8a795b6461c4029683689782ef1c161","spanId":"54fa20e32c66829f","parentSpanId":"","name":"/client-trade-view","kind":1,"startTimeUnixNano":"1746628420886910164","endTimeUnixNano":"1746628420900970691","attributes":[{"key":"size","value":{"intValue":"47"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"2"}}],"status":{}},{"traceId":"afc119195a84c34ab8afb06f413fba2e","spanId":"9df663c433491dca","parentSpanId":"22f6298ebf955d58","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628420918305833","endTimeUnixNano":"1746628420918307877","status":{}},{"traceId":"afc119195a84c34ab8afb06f413fba2e","spanId":"877ce5cc636c8e70","parentSpanId":"22f6298ebf955d58","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628420918330302","endTimeUnixNano":"1746628420918342724","status":{}},{"traceId":"afc119195a84c34ab8afb06f413fba2e","spanId":"71f8dc4585495b18","parentSpanId":"22f6298ebf955d58","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628420918528844","endTimeUnixNano":"1746628420918529998","status":{}},{"traceId":"afc119195a84c34ab8afb06f413fba2e","spanId":"fad11e232f96ffe7","parentSpanId":"595aba32bd674f0b","name":"execute","kind":1,"startTimeUnixNano":"1746628420919006108","endTimeUnixNano":"1746628420929778597","status":{}},{"traceId":"afc119195a84c34ab8afb06f413fba2e","spanId":"595aba32bd674f0b","parentSpanId":"22f6298ebf955d58","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628420919004708","endTimeUnixNano":"1746628420929779624","status":{}},{"traceId":"afc119195a84c34ab8afb06f413fba2e","spanId":"d6b6a51995590a17","parentSpanId":"22f6298ebf955d58","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628420929782385","endTimeUnixNano":"1746628420929805090","status":{}},{"traceId":"afc119195a84c34ab8afb06f413fba2e","spanId":"22f6298ebf955d58","parentSpanId":"","name":"/client-trade-view-search","kind":1,"startTimeUnixNano":"1746628420918191974","endTimeUnixNano":"1746628420929973209","attributes":[{"key":"size","value":{"intValue":"0"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"2"}}],"status":{}},{"traceId":"a9b758832f5e732b8098d4c48c57d73f","spanId":"807bee499a57f337","parentSpanId":"1fe23be50652318e","name":"execute","kind":1,"startTimeUnixNano":"1746628420775100753","endTimeUnixNano":"1746628420939682704","status":{}},{"traceId":"a9b758832f5e732b8098d4c48c57d73f","spanId":"1fe23be50652318e","parentSpanId":"e0a1fd2fb002331a","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628420775099726","endTimeUnixNano":"1746628420939686471","status":{}},{"traceId":"b0790574b30420a0fc79cba5df3a6c34","spanId":"35ecd7ec69867bfa","parentSpanId":"d906ab7c257a78a2","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628420942458392","endTimeUnixNano":"1746628420942460606","status":{}},{"traceId":"b0790574b30420a0fc79cba5df3a6c34","spanId":"a6da7ed613a38012","parentSpanId":"d906ab7c257a78a2","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628420942483110","endTimeUnixNano":"1746628420942494737","status":{}},{"traceId":"b0790574b30420a0fc79cba5df3a6c34","spanId":"5d2a0696f128a499","parentSpanId":"d906ab7c257a78a2","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628420942677536","endTimeUnixNano":"1746628420942678668","status":{}},{"traceId":"a9b758832f5e732b8098d4c48c57d73f","spanId":"14059c9afec8b0c9","parentSpanId":"e0a1fd2fb002331a","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628420939693485","endTimeUnixNano":"1746628420960635330","status":{}},{"traceId":"a9b758832f5e732b8098d4c48c57d73f","spanId":"e0a1fd2fb002331a","parentSpanId":"","name":"/client-trade-view","kind":1,"startTimeUnixNano":"1746628420774658018","endTimeUnixNano":"1746628420960807823","attributes":[{"key":"size","value":{"intValue":"7641"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"1"}}],"status":{}},{"traceId":"b0790574b30420a0fc79cba5df3a6c34","spanId":"a0f5d5862fbc2ffd","parentSpanId":"fb0ecb1b02e26fce","name":"execute","kind":1,"startTimeUnixNano":"1746628420943133033","endTimeUnixNano":"1746628420980410392","status":{}},{"traceId":"b0790574b30420a0fc79cba5df3a6c34","spanId":"fb0ecb1b02e26fce","parentSpanId":"d906ab7c257a78a2","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628420943131533","endTimeUnixNano":"1746628420980412536","status":{}},{"traceId":"b0790574b30420a0fc79cba5df3a6c34","spanId":"431fb5924989a550","parentSpanId":"d906ab7c257a78a2","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628420980417667","endTimeUnixNano":"1746628420980476867","status":{}},{"traceId":"b0790574b30420a0fc79cba5df3a6c34","spanId":"d906ab7c257a78a2","parentSpanId":"","name":"/client-trade-view-search","kind":1,"startTimeUnixNano":"1746628420942356795","endTimeUnixNano":"1746628420980745022","attributes":[{"key":"size","value":{"intValue":"17"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"2"}}],"status":{}},{"traceId":"e583fcc065674216086422d3c9f47f6e","spanId":"76c9dacacd4d7ba1","parentSpanId":"0da073ea2a903fe5","name":"execute","kind":1,"startTimeUnixNano":"1746628420856218433","endTimeUnixNano":"1746628421031932898","status":{}},{"traceId":"e583fcc065674216086422d3c9f47f6e","spanId":"0da073ea2a903fe5","parentSpanId":"1ab3c7611ba27228","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628420856215516","endTimeUnixNano":"1746628421031937826","status":{}},{"traceId":"e583fcc065674216086422d3c9f47f6e","spanId":"72f145d1fadfbba3","parentSpanId":"1ab3c7611ba27228","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628421031946055","endTimeUnixNano":"1746628421053671762","status":{}},{"traceId":"e583fcc065674216086422d3c9f47f6e","spanId":"1ab3c7611ba27228","parentSpanId":"","name":"/client-trade-view","kind":1,"startTimeUnixNano":"1746628420855464995","endTimeUnixNano":"1746628421053962602","attributes":[{"key":"size","value":{"intValue":"7786"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"1"}}],"status":{}},{"traceId":"15487f97e0097749221e2cd23e6e8642","spanId":"6c231eb1b866231a","parentSpanId":"af8082ec76244e91","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628421087627912","endTimeUnixNano":"1746628421087630228","status":{}},{"traceId":"15487f97e0097749221e2cd23e6e8642","spanId":"fd608cea27e9d16e","parentSpanId":"af8082ec76244e91","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628421087642323","endTimeUnixNano":"1746628421087659797","status":{}},{"traceId":"15487f97e0097749221e2cd23e6e8642","spanId":"db23e6a3c374479c","parentSpanId":"af8082ec76244e91","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628421087847046","endTimeUnixNano":"1746628421087848162","status":{}},{"traceId":"15487f97e0097749221e2cd23e6e8642","spanId":"53c6d6ae5658b130","parentSpanId":"0566fff5f5c55655","name":"execute","kind":1,"startTimeUnixNano":"1746628421088184339","endTimeUnixNano":"1746628421098723889","status":{}},{"traceId":"15487f97e0097749221e2cd23e6e8642","spanId":"0566fff5f5c55655","parentSpanId":"af8082ec76244e91","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628421088180963","endTimeUnixNano":"1746628421098725791","status":{}},{"traceId":"15487f97e0097749221e2cd23e6e8642","spanId":"e7306bf55276c4b8","parentSpanId":"af8082ec76244e91","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628421098730341","endTimeUnixNano":"1746628421098832203","status":{}},{"traceId":"15487f97e0097749221e2cd23e6e8642","spanId":"af8082ec76244e91","parentSpanId":"","name":"/client-trade-view","kind":1,"startTimeUnixNano":"1746628421087507863","endTimeUnixNano":"1746628421099038916","attributes":[{"key":"size","value":{"intValue":"24"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"0"}}],"status":{}},{"traceId":"d4dfc4a67bb13d70e2865f1ad5f87cde","spanId":"2a82dc677a1800cf","parentSpanId":"741dd8a368e9c89e","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628421773174823","endTimeUnixNano":"1746628421773176912","status":{}},{"traceId":"45918bdd3d12c299aa6df7a0078fcb40","spanId":"e556119ae99693bd","parentSpanId":"20f8e8d71547a8a8","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628421773201365","endTimeUnixNano":"1746628421773203392","status":{}},{"traceId":"d4dfc4a67bb13d70e2865f1ad5f87cde","spanId":"ea204ddedef24824","parentSpanId":"741dd8a368e9c89e","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628421773188833","endTimeUnixNano":"1746628421773206224","status":{}},{"traceId":"45918bdd3d12c299aa6df7a0078fcb40","spanId":"5d53122e27be3258","parentSpanId":"20f8e8d71547a8a8","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628421773217080","endTimeUnixNano":"1746628421773233800","status":{}},{"traceId":"d4dfc4a67bb13d70e2865f1ad5f87cde","spanId":"87bcf04d492a8a3c","parentSpanId":"741dd8a368e9c89e","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628421773390346","endTimeUnixNano":"1746628421773391441","status":{}},{"traceId":"45918bdd3d12c299aa6df7a0078fcb40","spanId":"9ef111aeabea3909","parentSpanId":"20f8e8d71547a8a8","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628421773417377","endTimeUnixNano":"1746628421773418511","status":{}},{"traceId":"d4dfc4a67bb13d70e2865f1ad5f87cde","spanId":"d19703908ee4c1ce","parentSpanId":"b803b30f77eaaa24","name":"execute","kind":1,"startTimeUnixNano":"1746628421773742534","endTimeUnixNano":"1746628421786953301","status":{}},{"traceId":"d4dfc4a67bb13d70e2865f1ad5f87cde","spanId":"b803b30f77eaaa24","parentSpanId":"741dd8a368e9c89e","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628421773740551","endTimeUnixNano":"1746628421786956642","status":{}},{"traceId":"d4dfc4a67bb13d70e2865f1ad5f87cde","spanId":"3f7fb9125d1a0f8f","parentSpanId":"741dd8a368e9c89e","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628421786963090","endTimeUnixNano":"1746628421787086420","status":{}},{"traceId":"d4dfc4a67bb13d70e2865f1ad5f87cde","spanId":"741dd8a368e9c89e","parentSpanId":"","name":"/client-trade-view","kind":1,"startTimeUnixNano":"1746628421773058108","endTimeUnixNano":"1746628421787240264","attributes":[{"key":"size","value":{"intValue":"28"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"0"}}],"status":{}},{"traceId":"d160045a83e32ba4ec28c6a9a1475733","spanId":"5a4eb404cf9e6312","parentSpanId":"9ae01e1e55dac87a","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628421846640986","endTimeUnixNano":"1746628421846642885","status":{}},{"traceId":"d160045a83e32ba4ec28c6a9a1475733","spanId":"9e2268c9c99c2e1d","parentSpanId":"9ae01e1e55dac87a","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628421846656528","endTimeUnixNano":"1746628421846673458","status":{}},{"traceId":"d160045a83e32ba4ec28c6a9a1475733","spanId":"01300e2fbc0865da","parentSpanId":"9ae01e1e55dac87a","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628421846860104","endTimeUnixNano":"1746628421846861168","status":{}},{"traceId":"3c39db31eeb373ea57ccb010266678e3","spanId":"b6ef11027d39c8be","parentSpanId":"0a8974c6d8ad8656","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628421889997096","endTimeUnixNano":"1746628421889998567","status":{}},{"traceId":"3c39db31eeb373ea57ccb010266678e3","spanId":"69dc35f8318fcabe","parentSpanId":"0a8974c6d8ad8656","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628421890007845","endTimeUnixNano":"1746628421890019261","status":{}},{"traceId":"3c39db31eeb373ea57ccb010266678e3","spanId":"0816ab8916bf92d6","parentSpanId":"0a8974c6d8ad8656","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628421890188250","endTimeUnixNano":"1746628421890189359","status":{}},{"traceId":"3c39db31eeb373ea57ccb010266678e3","spanId":"0e7e06baa1fa48f8","parentSpanId":"a19bbcce4f8d61b5","name":"execute","kind":1,"startTimeUnixNano":"1746628421890453694","endTimeUnixNano":"1746628421901416909","status":{}},{"traceId":"3c39db31eeb373ea57ccb010266678e3","spanId":"a19bbcce4f8d61b5","parentSpanId":"0a8974c6d8ad8656","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628421890452298","endTimeUnixNano":"1746628421901418130","status":{}},{"traceId":"3c39db31eeb373ea57ccb010266678e3","spanId":"7927074c605d9d23","parentSpanId":"0a8974c6d8ad8656","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628421901421759","endTimeUnixNano":"1746628421901447732","status":{}},{"traceId":"3c39db31eeb373ea57ccb010266678e3","spanId":"0a8974c6d8ad8656","parentSpanId":"","name":"/client-trade-view","kind":1,"startTimeUnixNano":"1746628421889908987","endTimeUnixNano":"1746628421901588134","attributes":[{"key":"size","value":{"intValue":"1"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"2"}}],"status":{}},{"traceId":"f5f1d83c34fbdfe537fc9324222a2328","spanId":"80f5169c404f9317","parentSpanId":"c02e7efa043b8e2e","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628421928490027","endTimeUnixNano":"1746628421928492089","status":{}},{"traceId":"528d37422c03d9a874ad21c87eafa298","spanId":"019612e8f6da9eff","parentSpanId":"a2b454e48fd31fb0","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628421928490006","endTimeUnixNano":"1746628421928492258","status":{}},{"traceId":"f5f1d83c34fbdfe537fc9324222a2328","spanId":"f78bd4eac11b5c8a","parentSpanId":"c02e7efa043b8e2e","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628421928517206","endTimeUnixNano":"1746628421928530281","status":{}},{"traceId":"528d37422c03d9a874ad21c87eafa298","spanId":"c04f6b32efe6be21","parentSpanId":"a2b454e48fd31fb0","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628421928517871","endTimeUnixNano":"1746628421928530571","status":{}},{"traceId":"f5f1d83c34fbdfe537fc9324222a2328","spanId":"cfbbf8e94d9f2b58","parentSpanId":"c02e7efa043b8e2e","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628421928727448","endTimeUnixNano":"1746628421928728568","status":{}},{"traceId":"528d37422c03d9a874ad21c87eafa298","spanId":"d0f1aa4e30e7f7b6","parentSpanId":"a2b454e48fd31fb0","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628421928734042","endTimeUnixNano":"1746628421928735139","status":{}},{"traceId":"f5f1d83c34fbdfe537fc9324222a2328","spanId":"4f91e0a90106c99b","parentSpanId":"1efccc10d9eb78c9","name":"execute","kind":1,"startTimeUnixNano":"1746628421929237499","endTimeUnixNano":"1746628421940952438","status":{}},{"traceId":"f5f1d83c34fbdfe537fc9324222a2328","spanId":"1efccc10d9eb78c9","parentSpanId":"c02e7efa043b8e2e","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628421929236005","endTimeUnixNano":"1746628421940953882","status":{}},{"traceId":"528d37422c03d9a874ad21c87eafa298","spanId":"c6307572d1a273a8","parentSpanId":"0f3b291967cebf26","name":"execute","kind":1,"startTimeUnixNano":"1746628421929317521","endTimeUnixNano":"1746628421940956913","status":{}},{"traceId":"528d37422c03d9a874ad21c87eafa298","spanId":"0f3b291967cebf26","parentSpanId":"a2b454e48fd31fb0","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628421929316338","endTimeUnixNano":"1746628421940957845","status":{}},{"traceId":"528d37422c03d9a874ad21c87eafa298","spanId":"f6223d310eed662c","parentSpanId":"a2b454e48fd31fb0","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628421940959491","endTimeUnixNano":"1746628421940978186","status":{}},{"traceId":"f5f1d83c34fbdfe537fc9324222a2328","spanId":"31841fafb41ec8b9","parentSpanId":"c02e7efa043b8e2e","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628421940957296","endTimeUnixNano":"1746628421940978195","status":{}},{"traceId":"f5f1d83c34fbdfe537fc9324222a2328","spanId":"c02e7efa043b8e2e","parentSpanId":"","name":"/client-trade-view-search","kind":1,"startTimeUnixNano":"1746628421928367328","endTimeUnixNano":"1746628421941148728","attributes":[{"key":"size","value":{"intValue":"0"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"2"}}],"status":{}},{"traceId":"528d37422c03d9a874ad21c87eafa298","spanId":"a2b454e48fd31fb0","parentSpanId":"","name":"/client-trade-view-search","kind":1,"startTimeUnixNano":"1746628421928367365","endTimeUnixNano":"1746628421941260284","attributes":[{"key":"size","value":{"intValue":"0"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"3"}}],"status":{}},{"traceId":"45918bdd3d12c299aa6df7a0078fcb40","spanId":"2d545aff93511dda","parentSpanId":"ea4d48c41d4defae","name":"execute","kind":1,"startTimeUnixNano":"1746628421773845816","endTimeUnixNano":"1746628421943936475","status":{}},{"traceId":"45918bdd3d12c299aa6df7a0078fcb40","spanId":"ea4d48c41d4defae","parentSpanId":"20f8e8d71547a8a8","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628421773844432","endTimeUnixNano":"1746628421943937686","status":{}},{"traceId":"45918bdd3d12c299aa6df7a0078fcb40","spanId":"b2df4de21f2da3cc","parentSpanId":"20f8e8d71547a8a8","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628421943939817","endTimeUnixNano":"1746628421962065662","status":{}},{"traceId":"45918bdd3d12c299aa6df7a0078fcb40","spanId":"20f8e8d71547a8a8","parentSpanId":"","name":"/client-trade-view","kind":1,"startTimeUnixNano":"1746628421773088382","endTimeUnixNano":"1746628421962467280","attributes":[{"key":"size","value":{"intValue":"7641"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"1"}}],"status":{}},{"traceId":"d160045a83e32ba4ec28c6a9a1475733","spanId":"0b1463d592f6df01","parentSpanId":"e3961796131d5263","name":"execute","kind":1,"startTimeUnixNano":"1746628421847194867","endTimeUnixNano":"1746628422025218716","status":{}},{"traceId":"d160045a83e32ba4ec28c6a9a1475733","spanId":"e3961796131d5263","parentSpanId":"9ae01e1e55dac87a","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628421847193227","endTimeUnixNano":"1746628422025221414","status":{}},{"traceId":"d160045a83e32ba4ec28c6a9a1475733","spanId":"c654e19e22d3b9d2","parentSpanId":"9ae01e1e55dac87a","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628422025227043","endTimeUnixNano":"1746628422044959052","status":{}},{"traceId":"d160045a83e32ba4ec28c6a9a1475733","spanId":"9ae01e1e55dac87a","parentSpanId":"","name":"/client-trade-view","kind":1,"startTimeUnixNano":"1746628421846518169","endTimeUnixNano":"1746628422045314517","attributes":[{"key":"size","value":{"intValue":"7786"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"1"}}],"status":{}},{"traceId":"5688714e5eb4f84a64ce19b004131712","spanId":"cf5e0e83c9995470","parentSpanId":"948dc1cadbd16bda","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628422080438319","endTimeUnixNano":"1746628422080440747","status":{}},{"traceId":"5688714e5eb4f84a64ce19b004131712","spanId":"12ddaf2a09e2b950","parentSpanId":"948dc1cadbd16bda","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628422080453848","endTimeUnixNano":"1746628422080471808","status":{}},{"traceId":"5688714e5eb4f84a64ce19b004131712","spanId":"6b28d8da4e6d15f5","parentSpanId":"948dc1cadbd16bda","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628422080676049","endTimeUnixNano":"1746628422080677239","status":{}},{"traceId":"5688714e5eb4f84a64ce19b004131712","spanId":"67a70ac4f3764d7b","parentSpanId":"a791143313555278","name":"execute","kind":1,"startTimeUnixNano":"1746628422081020739","endTimeUnixNano":"1746628422096145045","status":{}},{"traceId":"5688714e5eb4f84a64ce19b004131712","spanId":"a791143313555278","parentSpanId":"948dc1cadbd16bda","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628422081019320","endTimeUnixNano":"1746628422096146608","status":{}},{"traceId":"5688714e5eb4f84a64ce19b004131712","spanId":"7b4b8ee624898bca","parentSpanId":"948dc1cadbd16bda","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628422096151097","endTimeUnixNano":"1746628422096536184","status":{}},{"traceId":"5688714e5eb4f84a64ce19b004131712","spanId":"948dc1cadbd16bda","parentSpanId":"","name":"/client-trade-view","kind":1,"startTimeUnixNano":"1746628422080299350","endTimeUnixNano":"1746628422096745997","attributes":[{"key":"size","value":{"intValue":"262"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"0"}}],"status":{}},{"traceId":"cdb7a1f5511b5ad3f08d037380ce08ca","spanId":"d1bfef23b9d245ba","parentSpanId":"f23126b1121b40d2","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628422777768736","endTimeUnixNano":"1746628422777770776","status":{}},{"traceId":"cdb7a1f5511b5ad3f08d037380ce08ca","spanId":"01172953c4dbb38b","parentSpanId":"f23126b1121b40d2","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628422777782891","endTimeUnixNano":"1746628422777801080","status":{}},{"traceId":"cdb7a1f5511b5ad3f08d037380ce08ca","spanId":"6c0b2bdf200e1f98","parentSpanId":"f23126b1121b40d2","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628422777988741","endTimeUnixNano":"1746628422777989868","status":{}},{"traceId":"bb5a0f0cd1f5629acc5e074dda4dbfbb","spanId":"388912f4c67081fb","parentSpanId":"00a25ed9d8b897ac","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628422784881762","endTimeUnixNano":"1746628422784882896","status":{}},{"traceId":"bb5a0f0cd1f5629acc5e074dda4dbfbb","spanId":"ba780d0ad2b8063b","parentSpanId":"00a25ed9d8b897ac","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628422784889582","endTimeUnixNano":"1746628422784897004","status":{}},{"traceId":"bb5a0f0cd1f5629acc5e074dda4dbfbb","spanId":"03af25f41222e969","parentSpanId":"00a25ed9d8b897ac","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628422785050494","endTimeUnixNano":"1746628422785051595","status":{}},{"traceId":"bb5a0f0cd1f5629acc5e074dda4dbfbb","spanId":"67179dd2fdf07b6d","parentSpanId":"0b7115e309faf3b2","name":"execute","kind":1,"startTimeUnixNano":"1746628422785273972","endTimeUnixNano":"1746628422798409190","status":{}},{"traceId":"bb5a0f0cd1f5629acc5e074dda4dbfbb","spanId":"0b7115e309faf3b2","parentSpanId":"00a25ed9d8b897ac","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628422785272605","endTimeUnixNano":"1746628422798410283","status":{}},{"traceId":"bb5a0f0cd1f5629acc5e074dda4dbfbb","spanId":"05e7dc693f00c349","parentSpanId":"00a25ed9d8b897ac","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628422798413184","endTimeUnixNano":"1746628422798871753","status":{}},{"traceId":"bb5a0f0cd1f5629acc5e074dda4dbfbb","spanId":"00a25ed9d8b897ac","parentSpanId":"","name":"/client-trade-view","kind":1,"startTimeUnixNano":"1746628422784809176","endTimeUnixNano":"1746628422799036330","attributes":[{"key":"size","value":{"intValue":"306"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"1"}}],"status":{}},{"traceId":"2a0b25713663a747d724d339186cc667","spanId":"49e47e972793da6e","parentSpanId":"ce60b3cd7f7feb33","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628422853759330","endTimeUnixNano":"1746628422853760881","status":{}},{"traceId":"2a0b25713663a747d724d339186cc667","spanId":"c5110c81d9ccec00","parentSpanId":"ce60b3cd7f7feb33","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628422853770392","endTimeUnixNano":"1746628422853784244","status":{}},{"traceId":"2a0b25713663a747d724d339186cc667","spanId":"6df795163c8cada2","parentSpanId":"ce60b3cd7f7feb33","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628422853955056","endTimeUnixNano":"1746628422853956165","status":{}},{"traceId":"e77b3d512e8f3459a69857993a55c2f9","spanId":"1cd4222d512da1ac","parentSpanId":"ccc85594303db028","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628422887743431","endTimeUnixNano":"1746628422887744602","status":{}},{"traceId":"e77b3d512e8f3459a69857993a55c2f9","spanId":"cacd63f3847150d7","parentSpanId":"ccc85594303db028","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628422887751506","endTimeUnixNano":"1746628422887759638","status":{}},{"traceId":"e77b3d512e8f3459a69857993a55c2f9","spanId":"d6dadc6dc789d9f4","parentSpanId":"ccc85594303db028","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628422887914488","endTimeUnixNano":"1746628422887915589","status":{}},{"traceId":"e77b3d512e8f3459a69857993a55c2f9","spanId":"44a6a0d296398042","parentSpanId":"26b0419521865002","name":"execute","kind":1,"startTimeUnixNano":"1746628422888120441","endTimeUnixNano":"1746628422899282798","status":{}},{"traceId":"e77b3d512e8f3459a69857993a55c2f9","spanId":"26b0419521865002","parentSpanId":"ccc85594303db028","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628422888119148","endTimeUnixNano":"1746628422899283798","status":{}},{"traceId":"e77b3d512e8f3459a69857993a55c2f9","spanId":"471dd8ca54b2072d","parentSpanId":"ccc85594303db028","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628422899286373","endTimeUnixNano":"1746628422899343159","status":{}},{"traceId":"e77b3d512e8f3459a69857993a55c2f9","spanId":"ccc85594303db028","parentSpanId":"","name":"/client-trade-view","kind":1,"startTimeUnixNano":"1746628422887668782","endTimeUnixNano":"1746628422899500369","attributes":[{"key":"size","value":{"intValue":"24"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"2"}}],"status":{}},{"traceId":"1cb6b61ade55c83f0b78e28be5deaeac","spanId":"ee6997b0ce39a638","parentSpanId":"3e3bbdeb23415dd6","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628422946559425","endTimeUnixNano":"1746628422946561535","status":{}},{"traceId":"1dbf88b95efcd3fd02c98db023241aed","spanId":"62c9ecd342e4a403","parentSpanId":"1a732737f58d3114","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628422946559366","endTimeUnixNano":"1746628422946561465","status":{}},{"traceId":"1cb6b61ade55c83f0b78e28be5deaeac","spanId":"9aceddb7191487d6","parentSpanId":"3e3bbdeb23415dd6","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628422946582823","endTimeUnixNano":"1746628422946595222","status":{}},{"traceId":"1dbf88b95efcd3fd02c98db023241aed","spanId":"a89917c22cff78a9","parentSpanId":"1a732737f58d3114","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628422946582757","endTimeUnixNano":"1746628422946595198","status":{}},{"traceId":"1cb6b61ade55c83f0b78e28be5deaeac","spanId":"4c6384d4cc8bd6de","parentSpanId":"3e3bbdeb23415dd6","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628422946783467","endTimeUnixNano":"1746628422946784620","status":{}},{"traceId":"1dbf88b95efcd3fd02c98db023241aed","spanId":"1a31da34b1e925b8","parentSpanId":"1a732737f58d3114","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628422946783848","endTimeUnixNano":"1746628422946785015","status":{}},{"traceId":"cdb7a1f5511b5ad3f08d037380ce08ca","spanId":"3aa7151676cd507c","parentSpanId":"10ab8a31bb316b07","name":"execute","kind":1,"startTimeUnixNano":"1746628422778331926","endTimeUnixNano":"1746628422946795652","status":{}},{"traceId":"cdb7a1f5511b5ad3f08d037380ce08ca","spanId":"10ab8a31bb316b07","parentSpanId":"f23126b1121b40d2","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628422778328844","endTimeUnixNano":"1746628422946799703","status":{}},{"traceId":"1cb6b61ade55c83f0b78e28be5deaeac","spanId":"a0c87f591b5dec86","parentSpanId":"b6c250eafc383f79","name":"execute","kind":1,"startTimeUnixNano":"1746628422947226849","endTimeUnixNano":"1746628422959118422","status":{}},{"traceId":"1cb6b61ade55c83f0b78e28be5deaeac","spanId":"b6c250eafc383f79","parentSpanId":"3e3bbdeb23415dd6","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628422947225211","endTimeUnixNano":"1746628422959119712","status":{}},{"traceId":"1dbf88b95efcd3fd02c98db023241aed","spanId":"8061a28a0c2b1ff4","parentSpanId":"7237eef9358f4a18","name":"execute","kind":1,"startTimeUnixNano":"1746628422947248129","endTimeUnixNano":"1746628422959125100","status":{}},{"traceId":"1dbf88b95efcd3fd02c98db023241aed","spanId":"7237eef9358f4a18","parentSpanId":"1a732737f58d3114","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628422947246974","endTimeUnixNano":"1746628422959126064","status":{}},{"traceId":"1cb6b61ade55c83f0b78e28be5deaeac","spanId":"bea1fa43658e2829","parentSpanId":"3e3bbdeb23415dd6","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628422959122593","endTimeUnixNano":"1746628422959143470","status":{}},{"traceId":"1dbf88b95efcd3fd02c98db023241aed","spanId":"8e6e899ec18b3f5a","parentSpanId":"1a732737f58d3114","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628422959127925","endTimeUnixNano":"1746628422959143616","status":{}},{"traceId":"1cb6b61ade55c83f0b78e28be5deaeac","spanId":"3e3bbdeb23415dd6","parentSpanId":"","name":"/client-trade-view-search","kind":1,"startTimeUnixNano":"1746628422946432102","endTimeUnixNano":"1746628422959325670","attributes":[{"key":"size","value":{"intValue":"0"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"2"}}],"status":{}},{"traceId":"1dbf88b95efcd3fd02c98db023241aed","spanId":"1a732737f58d3114","parentSpanId":"","name":"/client-trade-view-search","kind":1,"startTimeUnixNano":"1746628422946432080","endTimeUnixNano":"1746628422959957157","attributes":[{"key":"size","value":{"intValue":"0"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"3"}}],"status":{}},{"traceId":"cdb7a1f5511b5ad3f08d037380ce08ca","spanId":"ef1b9ea8a5697afc","parentSpanId":"f23126b1121b40d2","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628422946807350","endTimeUnixNano":"1746628422968317972","status":{}},{"traceId":"cdb7a1f5511b5ad3f08d037380ce08ca","spanId":"f23126b1121b40d2","parentSpanId":"","name":"/client-trade-view","kind":1,"startTimeUnixNano":"1746628422777652146","endTimeUnixNano":"1746628422968491756","attributes":[{"key":"size","value":{"intValue":"7641"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"0"}}],"status":{}},{"traceId":"2a0b25713663a747d724d339186cc667","spanId":"a45a0ea7e07f1629","parentSpanId":"879f1d81604db4ba","name":"execute","kind":1,"startTimeUnixNano":"1746628422854206617","endTimeUnixNano":"1746628423035035731","status":{}},{"traceId":"2a0b25713663a747d724d339186cc667","spanId":"879f1d81604db4ba","parentSpanId":"ce60b3cd7f7feb33","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628422854205395","endTimeUnixNano":"1746628423035038846","status":{}},{"traceId":"2a0b25713663a747d724d339186cc667","spanId":"fdf816c31833f012","parentSpanId":"ce60b3cd7f7feb33","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628423035044352","endTimeUnixNano":"1746628423051482026","status":{}},{"traceId":"2a0b25713663a747d724d339186cc667","spanId":"ce60b3cd7f7feb33","parentSpanId":"","name":"/client-trade-view","kind":1,"startTimeUnixNano":"1746628422853673668","endTimeUnixNano":"1746628423051773340","attributes":[{"key":"size","value":{"intValue":"8122"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"1"}}],"status":{}},{"traceId":"e908fc49e239c64c2835062813a735a7","spanId":"ac2adb8a39e7353a","parentSpanId":"543710cabe780918","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628423089175114","endTimeUnixNano":"1746628423089177660","status":{}},{"traceId":"e908fc49e239c64c2835062813a735a7","spanId":"4fb8718de92a7a46","parentSpanId":"543710cabe780918","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628423089194348","endTimeUnixNano":"1746628423089217702","status":{}},{"traceId":"e908fc49e239c64c2835062813a735a7","spanId":"17bc1e3f1dfa6942","parentSpanId":"543710cabe780918","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628423089417364","endTimeUnixNano":"1746628423089418493","status":{}},{"traceId":"e908fc49e239c64c2835062813a735a7","spanId":"a6797a488ea456cc","parentSpanId":"5c3bd771a1bf4a02","name":"execute","kind":1,"startTimeUnixNano":"1746628423089809049","endTimeUnixNano":"1746628423103185955","status":{}},{"traceId":"e908fc49e239c64c2835062813a735a7","spanId":"5c3bd771a1bf4a02","parentSpanId":"543710cabe780918","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628423089807445","endTimeUnixNano":"1746628423103188030","status":{}},{"traceId":"e908fc49e239c64c2835062813a735a7","spanId":"81d1bbcdfa6e83d3","parentSpanId":"543710cabe780918","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628423103193647","endTimeUnixNano":"1746628423103691190","status":{}},{"traceId":"e908fc49e239c64c2835062813a735a7","spanId":"543710cabe780918","parentSpanId":"","name":"/client-trade-view","kind":1,"startTimeUnixNano":"1746628423089031346","endTimeUnixNano":"1746628423103913939","attributes":[{"key":"size","value":{"intValue":"212"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"0"}}],"status":{}},{"traceId":"0b7d28ef7bc0e861abd44245b14db07d","spanId":"1e0a64d98ea4f090","parentSpanId":"3852d1cec9c4e7e9","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628423766091486","endTimeUnixNano":"1746628423766094035","status":{}},{"traceId":"0b7d28ef7bc0e861abd44245b14db07d","spanId":"be8cd5426e50e09f","parentSpanId":"3852d1cec9c4e7e9","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628423766110045","endTimeUnixNano":"1746628423766132328","status":{}},{"traceId":"0b7d28ef7bc0e861abd44245b14db07d","spanId":"224212079f109abf","parentSpanId":"3852d1cec9c4e7e9","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628423766325062","endTimeUnixNano":"1746628423766326195","status":{}},{"traceId":"0b7d28ef7bc0e861abd44245b14db07d","spanId":"6bb8adc4687316dc","parentSpanId":"442eb7b8db94a755","name":"execute","kind":1,"startTimeUnixNano":"1746628423766681074","endTimeUnixNano":"1746628423777012366","status":{}},{"traceId":"0b7d28ef7bc0e861abd44245b14db07d","spanId":"442eb7b8db94a755","parentSpanId":"3852d1cec9c4e7e9","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628423766679540","endTimeUnixNano":"1746628423777014368","status":{}},{"traceId":"0b7d28ef7bc0e861abd44245b14db07d","spanId":"bb3ef75592c5a684","parentSpanId":"3852d1cec9c4e7e9","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628423777019079","endTimeUnixNano":"1746628423777117795","status":{}},{"traceId":"0b7d28ef7bc0e861abd44245b14db07d","spanId":"3852d1cec9c4e7e9","parentSpanId":"","name":"/client-trade-view","kind":1,"startTimeUnixNano":"1746628423765989364","endTimeUnixNano":"1746628423777303502","attributes":[{"key":"size","value":{"intValue":"26"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"0"}}],"status":{}},{"traceId":"bdeb1367435cc93eef9e1b5447e5fa9c","spanId":"100ead39e9ba9c31","parentSpanId":"26f3ddf26b04f0d0","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628423801531246","endTimeUnixNano":"1746628423801533080","status":{}},{"traceId":"bdeb1367435cc93eef9e1b5447e5fa9c","spanId":"e581de348cced7ad","parentSpanId":"26f3ddf26b04f0d0","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628423801543246","endTimeUnixNano":"1746628423801556976","status":{}},{"traceId":"bdeb1367435cc93eef9e1b5447e5fa9c","spanId":"f76932e3be8009ce","parentSpanId":"26f3ddf26b04f0d0","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628423801730818","endTimeUnixNano":"1746628423801731947","status":{}},{"traceId":"cf1db2f02742e31751645755c77a11f0","spanId":"cf5d6861daa263a6","parentSpanId":"a72e9dee48c56c56","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628423881384636","endTimeUnixNano":"1746628423881386635","status":{}},{"traceId":"cf1db2f02742e31751645755c77a11f0","spanId":"7eafee4408ef7f34","parentSpanId":"a72e9dee48c56c56","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628423881398988","endTimeUnixNano":"1746628423881414413","status":{}},{"traceId":"cf1db2f02742e31751645755c77a11f0","spanId":"47bdb700d152aeec","parentSpanId":"a72e9dee48c56c56","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628423881599265","endTimeUnixNano":"1746628423881600383","status":{}},{"traceId":"ce575e9c3ea65114d46c50a7978e2da0","spanId":"fa036620b35f0171","parentSpanId":"badb1e3874323ea6","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628423900969771","endTimeUnixNano":"1746628423900971145","status":{}},{"traceId":"ce575e9c3ea65114d46c50a7978e2da0","spanId":"acf3048962f94651","parentSpanId":"badb1e3874323ea6","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628423900978937","endTimeUnixNano":"1746628423900988567","status":{}},{"traceId":"ce575e9c3ea65114d46c50a7978e2da0","spanId":"1cc3f8bf679d0789","parentSpanId":"badb1e3874323ea6","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628423901150951","endTimeUnixNano":"1746628423901152079","status":{}},{"traceId":"4a6834c3abedebb76036c083d8b498e0","spanId":"b19b503e355f87ed","parentSpanId":"b06df1c1a076b7a0","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628423909057056","endTimeUnixNano":"1746628423909058424","status":{}},{"traceId":"4a6834c3abedebb76036c083d8b498e0","spanId":"fe1fa0120be89062","parentSpanId":"b06df1c1a076b7a0","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628423909076633","endTimeUnixNano":"1746628423909085549","status":{}},{"traceId":"4a6834c3abedebb76036c083d8b498e0","spanId":"c8e2b06e7cb4b502","parentSpanId":"b06df1c1a076b7a0","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628423909257094","endTimeUnixNano":"1746628423909258358","status":{}},{"traceId":"ce575e9c3ea65114d46c50a7978e2da0","spanId":"58fe2a0d5b96e691","parentSpanId":"01ded8ff4bb87446","name":"execute","kind":1,"startTimeUnixNano":"1746628423901403510","endTimeUnixNano":"1746628423919095432","status":{}},{"traceId":"ce575e9c3ea65114d46c50a7978e2da0","spanId":"01ded8ff4bb87446","parentSpanId":"badb1e3874323ea6","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628423901402088","endTimeUnixNano":"1746628423919096740","status":{}},{"traceId":"ce575e9c3ea65114d46c50a7978e2da0","spanId":"41f72d3a751f17f5","parentSpanId":"badb1e3874323ea6","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628423919099550","endTimeUnixNano":"1746628423919157381","status":{}},{"traceId":"ce575e9c3ea65114d46c50a7978e2da0","spanId":"badb1e3874323ea6","parentSpanId":"","name":"/client-trade-view","kind":1,"startTimeUnixNano":"1746628423900886402","endTimeUnixNano":"1746628423919306772","attributes":[{"key":"size","value":{"intValue":"20"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"2"}}],"status":{}},{"traceId":"4a6834c3abedebb76036c083d8b498e0","spanId":"3584e3f96cac5264","parentSpanId":"541032054ffa8a82","name":"execute","kind":1,"startTimeUnixNano":"1746628423909614810","endTimeUnixNano":"1746628423919877707","status":{}},{"traceId":"4a6834c3abedebb76036c083d8b498e0","spanId":"541032054ffa8a82","parentSpanId":"b06df1c1a076b7a0","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628423909613630","endTimeUnixNano":"1746628423919878668","status":{}},{"traceId":"4a6834c3abedebb76036c083d8b498e0","spanId":"b1e8ca4eaa132011","parentSpanId":"b06df1c1a076b7a0","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628423919880659","endTimeUnixNano":"1746628423919895473","status":{}},{"traceId":"4a6834c3abedebb76036c083d8b498e0","spanId":"b06df1c1a076b7a0","parentSpanId":"","name":"/client-trade-view-search","kind":1,"startTimeUnixNano":"1746628423908974529","endTimeUnixNano":"1746628423920059444","attributes":[{"key":"size","value":{"intValue":"0"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"3"}}],"status":{}},{"traceId":"ebbca258f4f7cce53e3e9f85099fc40b","spanId":"9b902b9ea13a28f7","parentSpanId":"09bd6923219bb5bf","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628423931528557","endTimeUnixNano":"1746628423931530077","status":{}},{"traceId":"ebbca258f4f7cce53e3e9f85099fc40b","spanId":"2beaa7637ee4baa9","parentSpanId":"09bd6923219bb5bf","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628423931547251","endTimeUnixNano":"1746628423931557142","status":{}},{"traceId":"ebbca258f4f7cce53e3e9f85099fc40b","spanId":"9bca0665d8a5159e","parentSpanId":"09bd6923219bb5bf","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628423931731393","endTimeUnixNano":"1746628423931732555","status":{}},{"traceId":"ebbca258f4f7cce53e3e9f85099fc40b","spanId":"98b20a21818effb7","parentSpanId":"80a79a40e14f959b","name":"execute","kind":1,"startTimeUnixNano":"1746628423932135160","endTimeUnixNano":"1746628423946559189","status":{}},{"traceId":"ebbca258f4f7cce53e3e9f85099fc40b","spanId":"80a79a40e14f959b","parentSpanId":"09bd6923219bb5bf","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628423932133676","endTimeUnixNano":"1746628423946560642","status":{}},{"traceId":"ebbca258f4f7cce53e3e9f85099fc40b","spanId":"0c62016f484ea257","parentSpanId":"09bd6923219bb5bf","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628423946564397","endTimeUnixNano":"1746628423946587244","status":{}},{"traceId":"ebbca258f4f7cce53e3e9f85099fc40b","spanId":"09bd6923219bb5bf","parentSpanId":"","name":"/client-trade-view-search","kind":1,"startTimeUnixNano":"1746628423931443555","endTimeUnixNano":"1746628423946786591","attributes":[{"key":"size","value":{"intValue":"0"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"2"}}],"status":{}},{"traceId":"bdeb1367435cc93eef9e1b5447e5fa9c","spanId":"799f5c9303a8926e","parentSpanId":"82b7a836fb3942cd","name":"execute","kind":1,"startTimeUnixNano":"1746628423802058483","endTimeUnixNano":"1746628423968230048","status":{}},{"traceId":"bdeb1367435cc93eef9e1b5447e5fa9c","spanId":"82b7a836fb3942cd","parentSpanId":"26f3ddf26b04f0d0","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628423802055976","endTimeUnixNano":"1746628423968231509","status":{}},{"traceId":"bdeb1367435cc93eef9e1b5447e5fa9c","spanId":"e4e311490da24846","parentSpanId":"26f3ddf26b04f0d0","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628423968234921","endTimeUnixNano":"1746628423983757732","status":{}},{"traceId":"bdeb1367435cc93eef9e1b5447e5fa9c","spanId":"26f3ddf26b04f0d0","parentSpanId":"","name":"/client-trade-view","kind":1,"startTimeUnixNano":"1746628423801455549","endTimeUnixNano":"1746628423984129682","attributes":[{"key":"size","value":{"intValue":"7641"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"0"}}],"status":{}},{"traceId":"cf1db2f02742e31751645755c77a11f0","spanId":"612be467acadd681","parentSpanId":"15971de86c319797","name":"execute","kind":1,"startTimeUnixNano":"1746628423881912116","endTimeUnixNano":"1746628424064145761","status":{}},{"traceId":"cf1db2f02742e31751645755c77a11f0","spanId":"15971de86c319797","parentSpanId":"a72e9dee48c56c56","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628423881910844","endTimeUnixNano":"1746628424064148608","status":{}},{"traceId":"cf1db2f02742e31751645755c77a11f0","spanId":"f083d9d5ec001b16","parentSpanId":"a72e9dee48c56c56","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628424064154176","endTimeUnixNano":"1746628424082112793","status":{}},{"traceId":"cf1db2f02742e31751645755c77a11f0","spanId":"a72e9dee48c56c56","parentSpanId":"","name":"/client-trade-view","kind":1,"startTimeUnixNano":"1746628423881269249","endTimeUnixNano":"1746628424082393720","attributes":[{"key":"size","value":{"intValue":"8122"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"1"}}],"status":{}},{"traceId":"8a9376c07480bc15dba35754b290216f","spanId":"b1b52f62eec12931","parentSpanId":"c61982898835b7c3","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628424107209646","endTimeUnixNano":"1746628424107212016","status":{}},{"traceId":"8a9376c07480bc15dba35754b290216f","spanId":"dd1dc944dce3e60c","parentSpanId":"c61982898835b7c3","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628424107224811","endTimeUnixNano":"1746628424107242394","status":{}},{"traceId":"8a9376c07480bc15dba35754b290216f","spanId":"e32722e249b428a5","parentSpanId":"c61982898835b7c3","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628424107428795","endTimeUnixNano":"1746628424107429939","status":{}},{"traceId":"8a9376c07480bc15dba35754b290216f","spanId":"3b0f2325bd21c907","parentSpanId":"0f520e6d5032927b","name":"execute","kind":1,"startTimeUnixNano":"1746628424107806953","endTimeUnixNano":"1746628424127730811","status":{}},{"traceId":"8a9376c07480bc15dba35754b290216f","spanId":"0f520e6d5032927b","parentSpanId":"c61982898835b7c3","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628424107804259","endTimeUnixNano":"1746628424127734817","status":{}},{"traceId":"8a9376c07480bc15dba35754b290216f","spanId":"a09a97509a91303a","parentSpanId":"c61982898835b7c3","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628424127741448","endTimeUnixNano":"1746628424129056362","status":{}},{"traceId":"8a9376c07480bc15dba35754b290216f","spanId":"c61982898835b7c3","parentSpanId":"","name":"/client-trade-view","kind":1,"startTimeUnixNano":"1746628424107091898","endTimeUnixNano":"1746628424129319036","attributes":[{"key":"size","value":{"intValue":"568"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"0"}}],"status":{}},{"traceId":"177dd224bede8ccaa59abe4f84ed4024","spanId":"67a3ec3e8a2bd261","parentSpanId":"fa5869b9f95119d0","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628424771632810","endTimeUnixNano":"1746628424771635054","status":{}},{"traceId":"177dd224bede8ccaa59abe4f84ed4024","spanId":"78a6b11107c9e1b1","parentSpanId":"fa5869b9f95119d0","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628424771647631","endTimeUnixNano":"1746628424771665503","status":{}},{"traceId":"177dd224bede8ccaa59abe4f84ed4024","spanId":"6a47eef748c2bed4","parentSpanId":"fa5869b9f95119d0","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628424771856193","endTimeUnixNano":"1746628424771857341","status":{}},{"traceId":"ded8dda856590851e3ba7b2169146948","spanId":"fc73a9bfbeca7458","parentSpanId":"2124280d6b5a49bb","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628424774326523","endTimeUnixNano":"1746628424774327717","status":{}},{"traceId":"ded8dda856590851e3ba7b2169146948","spanId":"c6ea34f38c871fb2","parentSpanId":"2124280d6b5a49bb","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628424774333510","endTimeUnixNano":"1746628424774340448","status":{}},{"traceId":"ded8dda856590851e3ba7b2169146948","spanId":"4b74c4d04ec0db60","parentSpanId":"2124280d6b5a49bb","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628424774496059","endTimeUnixNano":"1746628424774497232","status":{}},{"traceId":"177dd224bede8ccaa59abe4f84ed4024","spanId":"f33f9ef5d71ab967","parentSpanId":"875e9a440081d540","name":"execute","kind":1,"startTimeUnixNano":"1746628424772198936","endTimeUnixNano":"1746628424782795617","status":{}},{"traceId":"177dd224bede8ccaa59abe4f84ed4024","spanId":"875e9a440081d540","parentSpanId":"fa5869b9f95119d0","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628424772196876","endTimeUnixNano":"1746628424782798529","status":{}},{"traceId":"177dd224bede8ccaa59abe4f84ed4024","spanId":"50653a77d1896c98","parentSpanId":"fa5869b9f95119d0","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628424782804126","endTimeUnixNano":"1746628424782851419","status":{}},{"traceId":"177dd224bede8ccaa59abe4f84ed4024","spanId":"fa5869b9f95119d0","parentSpanId":"","name":"/client-trade-view","kind":1,"startTimeUnixNano":"1746628424771513679","endTimeUnixNano":"1746628424783017282","attributes":[{"key":"size","value":{"intValue":"2"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"0"}}],"status":{}},{"traceId":"fffbf5db98828a6ceef73d36e8cb26e9","spanId":"875180bfe0545792","parentSpanId":"22ae8a8fdd791f81","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628424854790232","endTimeUnixNano":"1746628424854792245","status":{}},{"traceId":"fffbf5db98828a6ceef73d36e8cb26e9","spanId":"591b397e119d5a59","parentSpanId":"22ae8a8fdd791f81","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628424854805498","endTimeUnixNano":"1746628424854822313","status":{}},{"traceId":"fffbf5db98828a6ceef73d36e8cb26e9","spanId":"924af7fec276f319","parentSpanId":"22ae8a8fdd791f81","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628424855006385","endTimeUnixNano":"1746628424855007455","status":{}},{"traceId":"9098b54c93add1c381dcd3adea116129","spanId":"2232ba7f50e11ea3","parentSpanId":"1e5f530f8e3e8f3e","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628424910563578","endTimeUnixNano":"1746628424910565460","status":{}},{"traceId":"9098b54c93add1c381dcd3adea116129","spanId":"d554841aebbeb76a","parentSpanId":"1e5f530f8e3e8f3e","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628424910586922","endTimeUnixNano":"1746628424910598375","status":{}},{"traceId":"9098b54c93add1c381dcd3adea116129","spanId":"c5c7ad5cf1948a3c","parentSpanId":"1e5f530f8e3e8f3e","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628424910784035","endTimeUnixNano":"1746628424910785154","status":{}},{"traceId":"9098b54c93add1c381dcd3adea116129","spanId":"f6bf65e977ffe239","parentSpanId":"77e957ef2e57b8ff","name":"execute","kind":1,"startTimeUnixNano":"1746628424911245472","endTimeUnixNano":"1746628424928102543","status":{}},{"traceId":"9098b54c93add1c381dcd3adea116129","spanId":"77e957ef2e57b8ff","parentSpanId":"1e5f530f8e3e8f3e","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628424911244059","endTimeUnixNano":"1746628424928104836","status":{}},{"traceId":"9098b54c93add1c381dcd3adea116129","spanId":"29f9b0ef6e6936da","parentSpanId":"1e5f530f8e3e8f3e","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628424928109779","endTimeUnixNano":"1746628424928135100","status":{}},{"traceId":"61df555eabf3b66cd8933809f00e409f","spanId":"936a5dc9ed7dc028","parentSpanId":"9d89432319715569","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628424928265438","endTimeUnixNano":"1746628424928267680","status":{}},{"traceId":"61df555eabf3b66cd8933809f00e409f","spanId":"db5670ac3a5ea8ed","parentSpanId":"9d89432319715569","name":"readLiveQuery","kind":1,"startTimeUnixNano":"1746628424928290524","endTimeUnixNano":"1746628424928301728","status":{}},{"traceId":"9098b54c93add1c381dcd3adea116129","spanId":"1e5f530f8e3e8f3e","parentSpanId":"","name":"/client-trade-view-search","kind":1,"startTimeUnixNano":"1746628424910452565","endTimeUnixNano":"1746628424928330978","attributes":[{"key":"size","value":{"intValue":"0"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"2"}}],"status":{}},{"traceId":"61df555eabf3b66cd8933809f00e409f","spanId":"74ff6a80a7e6cbd5","parentSpanId":"9d89432319715569","name":"referenceDataBuildClient","kind":1,"startTimeUnixNano":"1746628424928483515","endTimeUnixNano":"1746628424928484689","status":{}},{"traceId":"61df555eabf3b66cd8933809f00e409f","spanId":"6f263b9b420d92ff","parentSpanId":"987a90147b0c55b2","name":"execute","kind":1,"startTimeUnixNano":"1746628424928974821","endTimeUnixNano":"1746628424942932610","status":{}},{"traceId":"61df555eabf3b66cd8933809f00e409f","spanId":"987a90147b0c55b2","parentSpanId":"9d89432319715569","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628424928971882","endTimeUnixNano":"1746628424942935857","status":{}},{"traceId":"61df555eabf3b66cd8933809f00e409f","spanId":"67142c29131b39a5","parentSpanId":"9d89432319715569","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628424942942098","endTimeUnixNano":"1746628424942976185","status":{}},{"traceId":"ded8dda856590851e3ba7b2169146948","spanId":"3fac0b4cf92994a7","parentSpanId":"ead9f22035b491af","name":"execute","kind":1,"startTimeUnixNano":"1746628424774705063","endTimeUnixNano":"1746628424943113135","status":{}},{"traceId":"ded8dda856590851e3ba7b2169146948","spanId":"ead9f22035b491af","parentSpanId":"2124280d6b5a49bb","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628424774703616","endTimeUnixNano":"1746628424943114623","status":{}},{"traceId":"61df555eabf3b66cd8933809f00e409f","spanId":"9d89432319715569","parentSpanId":"","name":"/client-trade-view-search","kind":1,"startTimeUnixNano":"1746628424928177231","endTimeUnixNano":"1746628424943140053","attributes":[{"key":"size","value":{"intValue":"0"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"3"}}],"status":{}},{"traceId":"ded8dda856590851e3ba7b2169146948","spanId":"30bed27b7edec670","parentSpanId":"2124280d6b5a49bb","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628424943117528","endTimeUnixNano":"1746628424958752478","status":{}},{"traceId":"ded8dda856590851e3ba7b2169146948","spanId":"2124280d6b5a49bb","parentSpanId":"","name":"/client-trade-view","kind":1,"startTimeUnixNano":"1746628424774253005","endTimeUnixNano":"1746628424959012145","attributes":[{"key":"size","value":{"intValue":"7786"}},{"key":"view","value":{"stringValue":"D3131F0E-A7CE-E823-F65E-37642545BE49"}},{"key":"user","value":{"stringValue":"ADMIN"}},{"key":"group","value":{"stringValue":"IT_SUP_ALL"}},{"key":"concurrentRequests","value":{"intValue":"1"}}],"status":{}},{"traceId":"fffbf5db98828a6ceef73d36e8cb26e9","spanId":"bd9cb2d524a5dc67","parentSpanId":"074683b978d11bcf","name":"execute","kind":1,"startTimeUnixNano":"1746628424855337222","endTimeUnixNano":"1746628425036854881","status":{}},{"traceId":"fffbf5db98828a6ceef73d36e8cb26e9","spanId":"074683b978d11bcf","parentSpanId":"22ae8a8fdd791f81","name":"buildExecution","kind":1,"startTimeUnixNano":"1746628424855335354","endTimeUnixNano":"1746628425036857521","status":{}},{"traceId":"fffbf5db98828a6ceef73d36e8cb26e9","spanId":"7971be94bb5de2bd","parentSpanId":"22ae8a8fdd791f81","name":"adaptResponse","kind":1,"startTimeUnixNano":"1746628425036863041","endTimeUnixNano":"1746628425052869115","status":{}}]}]}]}  
Thanks so much this has been very helpful. I see we will need support help to install the app  
It's complicated Firstly, Splunk stores contents of raw data. Compressed. The compression ratio is more or less known in a typical text data scenario so we could estimate raw data usage. But tha... See more...
It's complicated Firstly, Splunk stores contents of raw data. Compressed. The compression ratio is more or less known in a typical text data scenario so we could estimate raw data usage. But that's definitely not all that Splunk stores about its indexed data. Firstly, it splits the data on major breakers and minor breakers and stores the resulting tokens along with "pointers" to the events they contain (there are some minute details about minor breakers but we'll not be digging into them here). So if you have an event Jan 23 2025 localhost test[23418] sample event Splunk will store the whole raw event in its raw event journal and will generate a "pointer" to that event within that journal (for the sake of this example we will assume the value of this "pointer" is 0xDEADBEEF; it doesn't matter what it looks like in reality internally) Addiitonally, Splunk will split the data and will add separate entries to its index with pointers to the original raw event from each of the split tokens. So the index will contain Token Pointers 2025 0xDEADBEEF 23 0xDEADBEEF 23418 0xDEADBEEF event 0xDEADBEEF jan 0xDEADBEEF localhost 0xDEADBEEF sample 0xDEADBEEF test 0xDEADBEEF Now if Splunk ingests another event Jan 24 2025 localhost test[23418] another sample event It will save it to the raw data journal, assign it another pointer - let's say it's 0x800A18A0. And it will update its index so that it contains now Token Pointers 2025 0xDEADBEEF,0x800A18A0 23 0xDEADBEEF 24 0x800A18A0 23418 0xDEADBEEF,0x800A18A0 another 0x800A18A0 event 0xDEADBEEF,0x800A18A0 jan 0xDEADBEEF,0x800A18A0 localhost 0xDEADBEEF,0x800A18A0 sample 0xDEADBEEF,0x800A18A0 test 0xDEADBEEF,0x800A18A0 So you can see that the actual index contents are highly dependent on the entropy of the data. If you have just one value or a small set of values which simply repeat throughout your whole data stream, the index will contain just a small set of unique values with a lot of "pointers" to the raw events. But if your events contain unique tokens, the index will grow in terms of indexed values and each of them will be pointing to just one raw event. So that's already complicated Additionally, if you create indexed fields, they are actually stored in the same index as the tokens parsed out of the raw event, they're just stored with the field name prefix. So if you created an indexed field called "mytestfield" with a value of "value1", it will be stored in the same index as the tokens, but it will just be saved as "mytestfield::value1". As an interesting trivia - indexed fields are undistinguishable of key::value tokens parsed out of raw data. So indeed, if you're creating indexed fields, you cause the index to grow. There is no simple linear dependency though since the growth depends on the cardinality of the field, the size of the field values (the size of the name itself too), and the number of events to which the index entry has to point. Additionally, Splunk stores some simple summarizing csv files (which are actually relatively negligible in size) as well as bloomfilter which is a kind of a simplified index containing just the tokens, without the relevant pointers. It might seem a bit redundant but is actually pretty useful - Splunk can determine whether to look for the term at all in the bucket without needing to process the full index which might be way bigger. So Splunk can simply skip searching through the particular bucket if it knows it won't find anything. So long story short - it's relatively complicated and there is no simple formula to give you a sure estimate how your data will grow if you - for example - add a single indexed field. The rule of thumb is that the "core" indexed data (the raw events along with essential metadata fields) is about 15% of the original size of the raw data and the indexes add another 35% of the original size of the raw data. But it's only the generalized estimation. There's no way to reliably calculate it beforehand since there are many factors that come into play.
Hi @Tafadzwa  If you download the "Splunk App for Content Packs" and then once installed, from the ITSI main menu, click Configuration > Data Integrations. Select Add content packs or Add structure... See more...
Hi @Tafadzwa  If you download the "Splunk App for Content Packs" and then once installed, from the ITSI main menu, click Configuration > Data Integrations. Select Add content packs or Add structure to your data depending on your version of ITSI. From here you should see the AppDynamics Content Pack.  Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing
Is the size of log after being stored in buckets compared to its raw size a metric I should monitor? This question came in my mind and the problem is I don't really know how to measure it, since fro... See more...
Is the size of log after being stored in buckets compared to its raw size a metric I should monitor? This question came in my mind and the problem is I don't really know how to measure it, since from the deployment/admin view, I can only view the size of a bucket. But a bucket can store logs from multiple hosts, and I don't know the size of the raw logs being sent from each host for a single bucket. So is there any formulas to calculate? AFAIK, the TRANSFORMS- function in props.conf is one of the main factors to increase size of log after being parsed, since it create index-time field extractions. Also, if there is none exact formula, has anyone calculate the log after being parse when using well-known app like parsing WinEventLog or Linux?
Well, we can't say retroactively what happened for sure. Syslog, especially UDP-transmitted one is sensitive to both network disruptions as well as receiver's performance. If the receiving Splunk in... See more...
Well, we can't say retroactively what happened for sure. Syslog, especially UDP-transmitted one is sensitive to both network disruptions as well as receiver's performance. If the receiving Splunk infrastructure listens for syslog directly with splunkd process, without external syslog daemons, that might have caused the receiver to be "overwhelmed" with a burst of data from other hosts and might have caused it to not process the incoming syslog data properly. Performance is one of the reasons why in production environment you generally shouldn't listen for syslog data directly with Splunk process. You should use an external syslog daemon. See https://docs.splunk.com/Documentation/SVA/current/Architectures/Syslog for possible syslog ingestion architectures.
Hi All,   Trying to find content pack for AppDynamics on Splunk Base. Kindly help.   Thanks
Hi PickleRick. Thank you for replying on the post. Our devices are sending syslogs to Splunk server over the network (there has not been, network issues). Secondly, we  our supplier noticed, that ... See more...
Hi PickleRick. Thank you for replying on the post. Our devices are sending syslogs to Splunk server over the network (there has not been, network issues). Secondly, we  our supplier noticed, that they was not recieving logs from one specefic host. And after some hours (approx 5), our Supplier was recieving logs from the specific host. While the supplier was not recieving logs from this host, they recieved a lot of logs from other hosts on our network. It happend around 04.47 (am) local time, on that time, there is not load on the network  Our supplier is maintaining indexes, and system work.  About the ingestion process stops, could that process stop for one host (one out of many), while the other hosts are not impacted ? Brgds DD
Hi @ArunkumarKarmeg  Sorry missed the last reply but I'm pleased you got it working!  Ye - in terms of APIs it doesnt make a lot of sense to have to query all users - If you have lots of users then... See more...
Hi @ArunkumarKarmeg  Sorry missed the last reply but I'm pleased you got it working!  Ye - in terms of APIs it doesnt make a lot of sense to have to query all users - If you have lots of users then this would be a lot of API calls just to get the groups. You'd think you would be able to get the role from a user list, or the user list from a role!  Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing
Hi @bill  If you're looking to see if the user is a Workflows Administrator then the following should work: | eval isAdmin=IF(typeof(mvfind('target{}.displayName', "Workflows Administrator"))=="Num... See more...
Hi @bill  If you're looking to see if the user is a Workflows Administrator then the following should work: | eval isAdmin=IF(typeof(mvfind('target{}.displayName', "Workflows Administrator"))=="Number","Yes","No")  Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing
Hi, Is this still open? DId we got a solution to extract complete server details monitored in APpdynamics. 
@livehybrid , Thanks a lot for your help on this.   Finally able to get the complete data of user list and their roles.   Still as a suggestion, this is very frustrating that to get a simple repo... See more...
@livehybrid , Thanks a lot for your help on this.   Finally able to get the complete data of user list and their roles.   Still as a suggestion, this is very frustrating that to get a simple report there is no out of the box option.   Thanks again.
What puzzles me here is why are you trying to split the data on the receiving end when you have control over the sending solution and it would be way easier and more maintainable to simply split the ... See more...
What puzzles me here is why are you trying to split the data on the receiving end when you have control over the sending solution and it would be way easier and more maintainable to simply split the array at the source and send each array member as separate event? Also remember then when sending to /event endpoint you're bypassing timestamp recognition unless you append that parameter which I always forget to the URI so you should send an explicit epoch-based timestamp along with your event. The upside to this is that you don't have to worry about date parsing in Splunk then.
We have automation to insert  /saved/searches endpoint and all is good.  Also current have quite lot of custom Splunk Enterprise Security (ESS) event-based detections handcrafted via the GUI in splun... See more...
We have automation to insert  /saved/searches endpoint and all is good.  Also current have quite lot of custom Splunk Enterprise Security (ESS) event-based detections handcrafted via the GUI in splunk cloud. (So can't directly put into savedsearches.conf) We have to automate these as they are not pure 'savedsearches'. We are following the ESCU  standards and use contentctl validate. All good till this stage But how to insert the ESCU detections into Splunk ESS? Which app to insert into? (SplunkEnterpriseSecuritySuite or DA-ESS-* type apps or can it be inserted into our own custom app itself?) Any API based automation into Splunk ESS is deeply appreciated thanks in advance
Before anything, let me first say that when you post JSON event sample, always use "Show raw text" before copying.  This helps others help you.  Secondly, as @bowesmana says, it is really unclear wha... See more...
Before anything, let me first say that when you post JSON event sample, always use "Show raw text" before copying.  This helps others help you.  Secondly, as @bowesmana says, it is really unclear what you are asking.  You already know the value "Workflows Administrator".  Do you mean to search for this value and display other related key-value pairs?  Or do you mean there are other possible values from the 3rd array element of target[] that you want to know how to reach that correct array element? If former, you need to specify which key-value pairs in that element are of interest.  If latter, there are many ways, including a method that does not do "extracting" because Splunk by default has done that for you.  But before doing that, you need to use Splunk's flattened-structure notation, not invented names like targetUserDisplayName. (Splunk's notation is target{}.displayName for this one.) Anyway, assuming the latter, @bowesmana already showed you several ways.  Here I first present a formulae approach to reach every JSON array node in SPL: spath + mvexpand.  But before I show any code, you need to perform the most critical task:  to understand how that element is different from other elements in the same array, all of them having a key displayName.  In order to make this determination, you need to carefully study the data.  The differentiating factor among those elements is the JSON key type in that array.  So, you would be looking for the element whose type is CUSTOM_ROLE. index=okta "debugContext.debugData.privilegeGranted"="*" | fields - target{}.* | spath path=target{} | mvexpand target{} | spath input=target{} | where type == "CUSTOM_ROLE" | rename actor.displayName as "Actor", displayName as "Target Name", alternateId as "Target ID", description as "Action", debugContext.debugData.privilegeGranted as "Role(s)" | table Time, Actor, Action, "Target Name", "Target ID", Action, "Role(s)" With this approach, you can handle any JSON array. If you don't want to (re)extract everything in the array - there are occasions when mvexpand can be too expensive, here is a quirky method that can do the same thing: capture the value of target{}.displayName and target{}.alternateId corresponding to target{}.type of CUSTOM_ROLE. index=okta "debugContext.debugData.privilegeGranted"="*" | eval type_index = mvfind('target{}.type', "CUSTOM_ROLE") | eval "Target Name" = mvindex('target{}.displayName', type_index) | eval "Target ID" = mvindex('target{}.alternateId', type_index) | rename actor.displayName as "Actor", description as "Action", debugContext.debugData.privilegeGranted as "Role(s)" | table Time, Actor, Action, "Target Name", "Target ID", Action, "Role(s)"
Yes, this is right. There's no copy/pasting. We may need to update some parameters to support larger upload, but apart from that we can simply upload the ES package from the UI, perform the setup and... See more...
Yes, this is right. There's no copy/pasting. We may need to update some parameters to support larger upload, but apart from that we can simply upload the ES package from the UI, perform the setup and deploy the Bundle.