Hi Everyone, I have two queries as shown below. For both I am doing sorting in different ways but stil there values are coming same. index=abc source="/splunkLogs/JOB_MDJX_CS_STATS_PLATINUM.csv"|jo...
See more...
Hi Everyone, I have two queries as shown below. For both I am doing sorting in different ways but stil there values are coming same. index=abc source="/splunkLogs/JOB_MDJX_CS_STATS_PLATINUM.csv"|join type=outer JOBFLOW_ID [ inputlookup JOB_MDJX_CS_MASTER_E3.csv ]|eval fields=split(_raw,",")|eval Environment=mvindex(fields,11)|eval JOBFLOW_ID=mvindex(fields,0) |eval JOB_EXEC_TIME=mvindex(fields,8)|eval RunDate=mvindex(fields,3)|where Environment="E3"|where JOBFLOW_ID LIKE "%%"|eval RunDate="20".mvindex(fields,3)|fieldformat Run_Date=strftime(Run_Date,"%d/%b/%Y")|eval TotalExecTime=round(TotalExecTime,2)|timechart useother=f sum(JOB_EXEC_TIME) as TotalExecTime by JOBFLOW_ID |sort -TotalExecTime limit=10 index=abc source="/splunkLogs/JOB_MDJX_CS_STATS_PLATINUM.csv"|join type=outer JOBFLOW_ID [ inputlookup JOB_MDJX_CS_MASTER_E3.csv ]|eval fields=split(_raw,",")|eval Environment=mvindex(fields,11)|eval JOBFLOW_ID=mvindex(fields,0) |eval JOB_EXEC_TIME=mvindex(fields,8)|eval RunDate=mvindex(fields,3)|where Environment="E3"|where JOBFLOW_ID LIKE "%%"|eval RunDate="20".mvindex(fields,3)|fieldformat Run_Date=strftime(Run_Date,"%d/%b/%Y")|eval TotalExecTime=round(TotalExecTime,2)|timechart useother=f sum(JOB_EXEC_TIME) as TotalExecTime by JOBFLOW_ID |sort TotalExecTime limit=10 Why there values are coming same can someone guide me. Thanks in advance