Hi Ninjas,
I have a radio button with two values as STARTING job and RUNNING jobs.
I have different query for each value. I would like to the corresponding value search should get filled it whe...
See more...
Hi Ninjas,
I have a radio button with two values as STARTING job and RUNNING jobs.
I have different query for each value. I would like to the corresponding value search should get filled it when user select the Status.
Following are the queries:
Starting Jobs Query:
ndex=infra_apps sourcetype=XXXX EventCode=40245 Status=Running AppID=$appid$ Machine=$host$ Job=$job$
| dedup _raw
| lookup datalakenodeslist.csv host as Machine OUTPUT cluster
| search cluster=$clustername$
| timechart count span=2m
Running Jobs Query:
index=infra_apps sourcetype=ca:atsys:edemon:txt EventCode=40245 AND (Status=STARTING OR Status=Running) AppID=$appid$ Machine=$host$ Job=$job$
| dedup _raw
| lookup datalakenodeslist.csv host as Machine OUTPUT cluster
| search cluster=$clustername$
| eval starting=if(Status="STARTING","1","0"),status=if(Status="STARTING","start","stop"), time=_time+status
| bin span=2m _time
| stats max(starting) as starting, earliest(time) as first, latest(time) as last by Job,_time
| xyseries _time Job starting first last
| makecontinuous span=2m _time
| streamstats window=2 global=f earliest(last*) as last*
| reverse
| streamstats window=2 global=f earliest(first*) as first*
| reverse
| foreach starting*
[ eval < >=if(isnull('< >') AND like('first< >',"%start"),"0",if(isnull('< >') AND like('first< >',"%stop"),"1",if(isnull('< >') AND like('last< >',"%start"),"1",if(isnull('< >') AND like('last< >',"%stop"),"0",'< >'))))]
| fields - first*, last*
| filldown *
| reverse
| filldown *
| reverse
| addtotals fieldname=Starting
| fields _time,Starting
PS: the token i am using is Status and the token value is jobstatus
Can you please help @vnravikumar @woodcock @sideview