Hello - I am looking for recommendations on combining 2 searches that use the same Lookup CSV but different columns in the CSV as the link to the lookup. Thank you all for taking a look and provid...
See more...
Hello - I am looking for recommendations on combining 2 searches that use the same Lookup CSV but different columns in the CSV as the link to the lookup. Thank you all for taking a look and providing insights. CSV lookup Columns Job_Config_Name,Job,Job_Thread_Name,Frequency_mins,Job_Name,Job_Type,Job_Task,Active Search 1 index="idx_cibca_App_prod" sourcetype = "tomcat:runtime:log:jpma" AND "lastUpdatedTS" OR "Time taken for" host=Server_1 OR host=Server_2 OR host=Server_3 OR host=Server_4 OR host=Server_5 OR host=Server_6 OR host=Server_7 OR host=Server_8 | rex "(?<Job_Thread_Name>[a-z].*Range)" | rex "(?<DATE_TIME>^(\d+)-(\d+)-(\d+)(\s+)(\d+):(\d+):(\d+).(\d+))" | stats latest(_time) as _time , latest(host) as host by Job_Thread_Name | lookup App-Job-Index-Lookup.csv Job_Thread_Name OUTPUTNEW | eval Thread_Last_Executed=strftime(_time, "%Y-%m-%d %I:%M:%S %p"), EPOC_Time=(_time) | eval Lag=round((now()-EPOC_Time)/60) | eval Status=if(isnull(Lag), "NOT OK - Job not running", if(Lag<= if(Frequency_mins>60, Frequency_mins+10, 70),"OK","NOT OK - Job not running - Lag found")) | table Job_Name, host, Job_Thread_Name, Frequency_mins,Job_Config_Name, Thread_Last_Executed,Lag,Status,Job_Status,Job_Status_Logged,TIMETAKEN_IN_MINS Search 2 index="idx_cibca_App_prod" sourcetype="tomcat:runtime:log:jpma" AND "Job Details job name:" host=Server_1 OR host=Server_2 OR host=Server_3 OR host=Server_4 OR host=Server_5 OR host=Server_6 OR host=Server_7 OR host=Server_8 | rex "Job Details job name:(?<Job_Config_Name>.*) status:(?<JOB_STATUS>.*) timetaken:(?<TIMETAKEN>.*) minutes" | rex "(?<DATE_TIME>^(\d+)-(\d+)-(\d+)(\s+)(\d+):(\d+):(\d+).(\d+))" | stats latest(DATE_TIME) AS Job_Status_Logged latest(JOB_STATUS) AS Job_Status, latest(TIMETAKEN) AS TIMETAKEN_IN_MINS by Job_Config_Name | lookup App-Job-Index-Lookup.csv Job_Config_Name OUTPUT Job_Name, Frequency_mins, Job_Config_Name, Job_Thread_Name | table Job_Name, Job_Thread_Name, Frequency_mins,Job_Status,Job_Status_Logged,TIMETAKEN_IN_MINS