The condition is not working for me  like('message' ,"%End of GL-import flow%") AND like('tracePoint',"EXCEPTION") ,"SUCCESS", If the message value=End of GL-import flow and tracepoint values=Exception then it should be SUCCESS.Screen shot attached below index="mulesoft" applicationName="p-oracle-finance-ext" environment=DEV (*End of GL-import flow*) OR (tracePoint="EXCEPTION") OR (priority="WARN" AND message="GLImport Job Already Running, Please wait for the job to complete*") OR ( message="End of GL Import process - No files found for import to ISG") | rename content.File.fstatus as Status | eval Status=case( like('Status' ,"SUCCESS") ,"SUCCESS", like('message' ,"%End of GL-import flow%") AND like('tracePoint',"EXCEPTION") ,"SUCCESS", like('tracePoint',"EXCEPTION") AND like('priority' ,"%ERROR%"),"ERROR", like('Status',"ERROR"),"ERROR", like('priority',"WARN"),"WARN", like('priority',"GLImport Job Already Running, Please wait for the job to complete%"),"WARN", like('message',"%End of GL Import process - No files found for import to ISG%"), "ERROR", 1==1, "") | stats values(content.File.fid) as "TransferBatch/OnDemand" values(content.File.fname) as "BatchName/FileName" values(content.File.fprocess_message) as ProcessMsg values(Status) as Status values(content.File.isg_file_batch_id) as OracleBatchID values(content.File.total_rec_count) as "Total Record Count" values(message) as message values(timestamp) as timestamp values(content.errorType) as errorType by correlationId | eval ProcessMsg= coalesce(ProcessMsg,errorType,message) | eventstats min(timestamp) AS Start_Time, max(timestamp) AS End_Time by correlationId | eval StartTime=round(strptime(Start_Time, "%Y-%m-%dT%H:%M:%S.%QZ")) | eval EndTime=round(strptime(End_Time, "%Y-%m-%dT%H:%M:%S.%QZ")) | eval ElapsedTimeInSecs=EndTime-StartTime | eval "Total Elapsed Time"=strftime(ElapsedTimeInSecs,"%H:%M:%S") | table Status Start_Time "TransferBatch/OnDemand" "BatchName/FileName" ProcessMsg OracleBatchID "Total Record Count" ElapsedTimeInSecs "Total Elapsed Time" correlationId | join correlationId type=left [ search index="mulesoft" applicationName="p-oracle-finance-ext" environment=DEV (message="API: START: /v1/revpro-to-oracle/onDemand*") OR (message="API: START: /v1/fin_Zuora_GL_Revpro_JournalImport") OR (message="API: START: /v1/revproGLImport/onDemand*") | eval JobType=case( like('message',"API: START: /v1/revproGLImport/onDemand%"),"OnDemand", like('message',"API: START: /v1/revpro-to-oracle/onDemand%"),"OnDemand", like('message',"API: START: /v1/fin_Zuora_GL_Revpro_JournalImport"),"Scheduled") | table JobType correlationId ] | table Status JobType Start_Time "TransferBatch/OnDemand" "BatchName/FileName" ProcessMsg OracleBatchID "Total Record Count" ElapsedTimeInSecs "Total Elapsed Time" correlationId | fields - ElapsedTimeInSecs | where JobType!=" "   ... View more

Thanks you made my day.I need to show in the dashbaord table how to use table after stats and i am getting warning message 'list' command: Limit of '100' for values reached. Additional values may have been truncated or ignored.   And your mind-reading one and three is working as expected result and i have a queries that my content list have 134 batch_ID .But the splunk extracted and shows 26 counts, rest of the things are not showing .how can i handle this.I need to fix that issue.Will this need to be extract from props and transform.conf file while indexing the data.Please help me to fix it. ... View more

Hi @yuanliu  I attached with correlationId .So if we extract the result the result go beyond pagination in the table as well right. { "correlationId" : "490cfba0e9f3c770b40", "message" : "Processed all revenueData", "tracePoint" : "FLOW", "priority" : "INFO", "category" : "prc-api", "elapsed" : 472, "locationInfo" : { "lineInFile" : "205", "component" : "json-logger:logger", "fileName" : "G.xml", "rootContainer" : "syncFlow" }, "timestamp" : "2024-03-06T20:57:17.119Z", "content" : { "List of Batches Processed" : [ { "P_REQUEST_ID" : "1005377", "P_BATCH_ID" : "1", "P_TEMPLATE" : "Template", "P_PERIOD" : "MAR-24", "P_MORE_BATCHES_EXISTS" : "Y", "P_FILE_NAME" : "Template20240306102852.csv", "P_MESSAGE" : "Data loaded in RevPro Successfully - Success: 10000 Failed: 0", "P_RETURN_STATUS" : "SUCCESS" }, { "P_REQUEST_ID" : "1005177", "P_BATCH_ID" : "2", "P_TEMPLATE" : "Template", "P_PERIOD" : "MAR-24", "P_MORE_BATCHES_EXISTS" : "Y", "P_FILE_NAME" : "Template20240306102959.csv", "P_MESSAGE" : "Data loaded in RevPro Successfully - Success: 10000 Failed: 0", "P_RETURN_STATUS" : "SUCCESS" }, { "P_REQUEST_ID" : "1005377", "P_BATCH_ID" : "3", "P_TEMPLATE" : "Template", "P_PERIOD" : "MAR-24", "P_MORE_BATCHES_EXISTS" : "Y", "P_ZUORA_FILE_NAME" : "Template20240306103103.csv", "P_MESSAGE" : "Data loaded in RevPro Successfully - Success: 10000 Failed: 0", "P_RETURN_STATUS" : "SUCCESS" }, { "P_REQUEST_ID" : "1005377", "P_BATCH_ID" : "4", "P_TEMPLATE" : "Template", "P_PERIOD" : "MAR-24", "P_MORE_BATCHES_EXISTS" : "Y", "P_ZUORA_FILE_NAME" : "Template20240306103205.csv", "P_MESSAGE" : "Data loaded in RevPro Successfully - Success: 10000 Failed: 0", "P_RETURN_STATUS" : "SUCCESS" }, { "P_REQUEST_ID" : "1005377", "P_BATCH_ID" : "5", "P_TEMPLATE" : "Template", "P_PERIOD" : "MAR-24", "P_MORE_BATCHES_EXISTS" : "Y", "P_FILE_NAME" : "Template20240306103306.csv", "P_MESSAGE" : "Data loaded in RevPro Successfully - Success: 10000 Failed: 0", "P_RETURN_STATUS" : "SUCCESS" }, { "P_REQUEST_ID" : "100532177", "P_BATCH_ID" : "6", "P_TEMPLATE" : "ATVI_Transaction_Template", "P_PERIOD" : "MAR-24", "P_MORE_BATCHES_EXISTS" : "Y", "P_ZUORA_FILE_NAME" : "rev_ATVI_Transaction_Template20240306103407.csv", "P_MESSAGE" : "Data loaded in RevPro Successfully - Success: 10000 Failed: 0", "P_RETURN_STATUS" : "SUCCESS" }   ... View more

The value which we are seeing it is in single corellationId.so i want to display like correlationID BatchId RequestID Status 125dfe5 1 2 3 117 112| 1156 Success Success Success 32435sf53 1 2 324 536 643 Success Success         ... View more

Working 👍 ... View more

Hi @richgalloway  As you mentioned match condition in case statement.let me share the query.If i use match i am not getting the Status field index="mule" applicationName="api" environment=DEV timestamp (message="onDemand Flow for concur Expense Report file with FileID Started") OR (message="Exchange Rates Scheduler process started") OR (message="Exchange Rates Process Completed. File successfully sent to Concur*") OR (message="DEV(SUCCESS): Exchange Rates OnDemand Interface Run Report - Concur") OR ("TEST(SUCCESS): Exchange Rates OnDemand Interface Run Report - Concur") OR ("PRD(SUCCESS): Exchange Rates Interface Run Report - Concur")|transaction correlationId| rename timestamp as Timestamp correlationId as CorrelationId tracePoint as TracePoint content.payload.TargetFileName as TargetFileName | eval JobType=case(like('message',"%onDemand Flow for concur Expense Report file with FileID Started%"),"OnDemand",like('message',"%Exchange Rates Scheduler process started%"),"Scheduled", true() , "Unknown") | eval Status=case(like('message',"%Exchange Rates Process Completed. File sucessfully sent to Concur%"),"SUCCESS",match('message',"%(TEST|DEV|PRD)(SUCCESS): Exchange Rates OnDemand Interface Run Report - Concur%"),"SUCCESS",like('TracePoint',"%EXCEPTION%"),"ERROR") |eventstats min(Timestamp) AS Start_Time, max(Timestamp) AS End_Time by CorrelationId | eval StartTime=round(strptime(Start_Time, "%Y-%m-%dT%H:%M:%S.%QZ")) | eval EndTime=round(strptime(End_Time, "%Y-%m-%dT%H:%M:%S.%QZ")) | eval ElapsedTimeInSecs=EndTime-StartTime | eval "Total Elapsed Time"=strftime(ElapsedTimeInSecs,"%H:%M:%S") |rename Start_Time as Timestamp | table Status JobType ElapsedTimeInSecs "Total Elapsed Time" Timestamp CorrelationId message TargetFileName   ... View more

@richgalloway Its not working ... View more

Thanks  Working as expected 😊. ... View more

Yes i tried but in my case need to extract whole content.payload as one field. ... View more

Hi @gcusello @ Splunk dashboard performance Issue   Let me explain my requirement properly. I have message field and i need to extract multiple values from message fileds .for that is used multiple joins so its dashboard taking time to load fast. So as you mention in the answer use stats command .I tried to used stats but i cant able to get it in table . In real time senario: I am giving field with keywords   Three are two jobtype  xxx and yyy Message : "concur ondemand" and "expense"  --- Started Successfuly. Message : "Error "                                                           ---Error Message : Progress completed                                ------ completed  and we have unique correlationID.Based on correlation ID we need find out the result. I will copy paste that you suggested to using stats but i am not well in that can you please help to fix the issue.             index="xxx" applicationName="api" environment=DEV timestamp correlationId tracePoint message ("Concur Ondemand Started*") OR (message="Expense Extract Process started for jobName : AP/GL Extract V.3.0*") OR (trace=ERROR) OR ("Before Calling flow archive-Concur*") OR (message="Concur AP/GL File/s Process Status*")|dedup correlationId | rename content.SourceFileName as SourceFileName content.JobName as JobName | eval "FileName/JobName"= coalesce(SourceFileName,JobName) | rename timestamp as Timestamp correlationId as CorrelationId tracePoint as TracePoint message as Message | eval JobType=case(like('Message',"%Concur Ondemand Started%"), "OnDemand", like('Message',"%Expense Extract Process started for jobName : *%"), "Scheduled") | eval Message=trim(Message,"\"") | rename correlationId as CorrelationId tracePoint as TracePoint message as Message | rename content.loggerPayload.archiveFileName AS ArchivedFileName | eval Status=case(like('Message' ,"%Concur AP/GL File/s Process Status%"),"SUCCESS", like('TracePoint',"%EXCEPTION%"),"ERROR") | eval Response= coalesce(Response,Message) | eval Status=if(TracePoint="ERROR","ERROR",Status) | join CorrelationId type=left [ search index="xxx" applicationName="api" | stats earliest(timestamp) AS Timestamp values(TracePoint) AS TracePoint values(Response) AS Response values(JobType) AS JobType values(Status) AS Status values("FileName/JobName") AS "FileName/JobName" values(Message) AS Message BY CorrelationId]           Status    FileName/JobNam JobType ArchivedFileName CorrelationId Timestamp  SUCCESS karthi xxx test1 2essrfsf4dgs   SUCCESS priya yyy test2 46dsfh68   ... View more