Hi All, I have an issue while trying to reconcile events from 3 different source types, the events from each sourcetype below is from DBConnect, they run every 1 hour. I tried to schedule the alert ...
See more...
Hi All, I have an issue while trying to reconcile events from 3 different source types, the events from each sourcetype below is from DBConnect, they run every 1 hour. I tried to schedule the alert to look into events last 3 hours, i get all the events instead of just the difference. tried mvexpand as well but didnt help much. the whole idea is to reconcile events from 3 different sourcetypes and get the result od missing SMS_RECORD out to team to look into. index=month source=XYZ sourcetype=OVERDRAFT_REC1 | dedup SMS_RECORD | eval TIMESTAMP=strftime(strptime(TIMESTAMP,"%d-%b-%y %H:%M:%S"),"%d-%m-%Y %H:%M") | stats values(SMS_RECORD) AS IN_T1 BY TIMESTAMP | append [ search index=month source=XYZ sourcetype=OVERDRAFT_REC2 | dedup SMS_RECORD | eval TIMESTAMP=strftime(strptime(TIMESTAMP,"%Y-%m-%d %H:%M:%S.%6Q"),"%d-%m-%Y %H:%M") | stats values(SMS_RECORD) AS IN_I1 BY TIMESTAMP ] | append [ search index=month source=XYZ sourcetype=OVERDRAFT_REC3 | dedup SMS_RECORD | eval TIMESTAMP=strftime(strptime(TIMESTAMP,"%Y-%m-%d %H:%M:%S.%6Q"),"%d-%m-%Y %H:%M") | stats values(SMS_RECORD) AS IN_TXT1 BY TIMESTAMP ] | mvexpand IN_T1 | mvexpand IN_I1 | mvexpand IN_TXT1 | stats values(IN_T1) AS T1,values(IN_I1) AS I1,values(IN_TXT1) AS TXT1 BY TIMESTAMP | where T1!=I1 OR I1!=TXT1 OR TXT1!=T1