Hello good people of the splunk community. I'm fairly new to splunk so sorry if this is a newb question. I have a search that retrieves only events with certain field values in the Procedure_Name o...
See more...
Hello good people of the splunk community. I'm fairly new to splunk so sorry if this is a newb question. I have a search that retrieves only events with certain field values in the Procedure_Name or Process_Name fields, groups them by our scheduling cycle, and displays which procedures/processes failed (indicated by activity code not being 2000): (index=app host=myhost sourcetype=mysourcetype) OR (index=myindex source=mysource) earliest=-1w@w latest=now
| where Process_Name IN ("Process1","Process2","Process3"..."Process26")
OR
Procedure_Name IN ("Procedure1","Procedure2","Procedure3"..."Procedure26"))
| fields Procedure_Name,Process_Name,Activity_Code, UpdatedDate
| eval Procedure_Name=coalesce(Process_Name, Procedure_Name)
| eval update = strptime( UpdatedDate, "%Y-%m-%d %H:%M:%S")
| eval Day = relative_time(update,"@d") - if((tonumber(strftime(update, "%H%M")) < 1400), (24*60*60), 0)
| dedup Procedure_Name Day
| stats count(eval(Activity_Code = "2000")) as Success_Count, values(eval(if(Activity_Code !="2000", Procedure_Name,null()))) as Failures, values(Procedure_Name) as AllProcedures, values(UpdatedDate) as UpdatedDate, count as Procedure_Count by Day
| eval Success_Percent = round(((Success_Count/Procedure_Count)*100),2)
| sort - Day
| eval Day = strftime(Day, "%F")
| table Day, Success_Count, Procedure_Count, Success_Percent, Failures, AllProcedures,UpdatedDate The process and procedure lists I'm checking for are actually identical, so Process1 is the same as Procedure1, Process6=Procedure6, etc. However I want to account for procedures/processes that failed to run at all since we consider that a failure too. But because they didn't run there are no events for them. Is there some way to compare my list of procedures/processes that should be there to the list that's actually there(AllProcedures) and add the difference to my failures list or another list like "FailedToRun"?