How to set status message for job not ran on saturday and sunday .here the query which i used in case statement.In my query its only working for saturday.but not getting for sunday. Thanks in advanc...
See more...
How to set status message for job not ran on saturday and sunday .here the query which i used in case statement.In my query its only working for saturday.but not getting for sunday. Thanks in advance index=xx* app_name="xxx" OR cf_app_name="yyy*" OR app_name="ccc"
|span_time span=1d |eval dayweek=strftime(_time,"%H")|convert timeformat="%m-%d-%y" ctime(_time) as c_time|eval Job = case(like(msg, "%first%"), "first Job", like(msg, "%second%"), "second Job", like(msg, "%third%"), "third job",like(msg, "%fourth%"), "fourth job")| stats count(eval(like(msg, "%All feed is completed%") OR like(msg, "%Success:%") OR like(msg, "%Success: %") OR like(msg, "%Finished success%"))) as Successcount count(eval(like(msg, "%Fatal Error: %") OR like(msg, "%Fatal Error:%") OR like(msg, "%Job raised exception%") AND like(msg, "% job error%"))) as failurecount by Job c_time dayweek|eval status=case((Job="fourth job") AND (dayweek=="Saturday" OR dayweek=="Sunday"),"NA",Successcount>0,"Success",failurecount>0,"Failure")| xyseries Job c_time status