cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
karthi2809
Builder
Member since: ‎12-07-2016
37 seconds ago
Community Statistics
Posts 217
Solutions 0
Karma Given 90
Karma Received 6
Member Since ‎12-07-2016
Activity Feed
Topics I've Started
View All

Re: Splunk dashboard performance Issue

by in Dashboards & Visualizations
‎02-26-2024 05:13 AM
‎02-26-2024 05:13 AM
Hi @gcusello @ Splunk dashboard performance Issue   Let me explain my requirement properly. I have message field and i need to extract multiple values from message fileds .for that is used multiple joins so its dashboard taking time to load fast. So as you mention in the answer use stats command .I tried to used stats but i cant able to get it in table . In real time senario: I am giving field with keywords   Three are two jobtype  xxx and yyy Message : "concur ondemand" and "expense"  --- Started Successfuly. Message : "Error "                                                           ---Error Message : Progress completed                                ------ completed  and we have unique correlationID.Based on correlation ID we need find out the result. I will copy paste that you suggested to using stats but i am not well in that can you please help to fix the issue.             index="xxx" applicationName="api" environment=DEV timestamp correlationId tracePoint message ("Concur Ondemand Started*") OR (message="Expense Extract Process started for jobName : AP/GL Extract V.3.0*") OR (trace=ERROR) OR ("Before Calling flow archive-Concur*") OR (message="Concur AP/GL File/s Process Status*")|dedup correlationId | rename content.SourceFileName as SourceFileName content.JobName as JobName | eval "FileName/JobName"= coalesce(SourceFileName,JobName) | rename timestamp as Timestamp correlationId as CorrelationId tracePoint as TracePoint message as Message | eval JobType=case(like('Message',"%Concur Ondemand Started%"), "OnDemand", like('Message',"%Expense Extract Process started for jobName : *%"), "Scheduled") | eval Message=trim(Message,"\"") | rename correlationId as CorrelationId tracePoint as TracePoint message as Message | rename content.loggerPayload.archiveFileName AS ArchivedFileName | eval Status=case(like('Message' ,"%Concur AP/GL File/s Process Status%"),"SUCCESS", like('TracePoint',"%EXCEPTION%"),"ERROR") | eval Response= coalesce(Response,Message) | eval Status=if(TracePoint="ERROR","ERROR",Status) | join CorrelationId type=left [ search index="xxx" applicationName="api" | stats earliest(timestamp) AS Timestamp values(TracePoint) AS TracePoint values(Response) AS Response values(JobType) AS JobType values(Status) AS Status values("FileName/JobName") AS "FileName/JobName" values(Message) AS Message BY CorrelationId]           Status    FileName/JobNam JobType ArchivedFileName CorrelationId Timestamp  SUCCESS karthi xxx test1 2essrfsf4dgs   SUCCESS priya yyy test2 46dsfh68   ... View more

Multiple joins cause slowness in splunk dashboard?...

by in Splunk Search
‎02-23-2024 09:11 AM
‎02-23-2024 09:11 AM
Multiple joins cause slowness in splunk dashboard?Is any other way to make faster? how  can we club those joins ?   index="xxx" applicationName="api" environment=$env$ timestamp correlationId trace message ("Ondemand Started*" OR "Expense Process started") |rename sourceFileName as SourceFileName content.JobName as JobName | eval "FileName/JobName"= coalesce(SourceFileName,JobName) | rename timestamp as Timestamp correlationId as CorrelationId tracePoint as Tracepoint message as Message | eval JobType=case(like('Message',"%Ondemand Started%"),"OnDemand",like('Message',"Expense Process started%"),"Scheduled", true() , "Unknown") | eval Message=trim(Message,"\"") | table Timestamp CorrelationId Tracepoint JobType "FileName/JobName" Message | join CorrelationId type=left [ search index="xxx" applicationName="api" trace=ERROR | rename correlationId as CorrelationId traceas TracePoint message as StatusMessage | dedup CorrelationId | table CorrelationId TracePoint StatusMessage] | table Timestamp CorrelationId TracePoint JobType "FileName/JobName" StatusMessage | join CorrelationId type=left [ search index="xxx" applicationName="api" message="*Before Calling flow archive-Concur*" | rename correlationId as CorrelationId content.loggerPayload.archiveFileName as ArchivedFileName | table CorrelationId ArchivedFileName] | table Timestamp CorrelationId Tracepoint JobType "FileName/JobName" ArchivedFileName StatusMessage     ... View more
Labels

Splunk Dashboard pre-requirement Document template...

by in Dashboards & Visualizations
‎02-23-2024 03:44 AM
‎02-23-2024 03:44 AM
Hi, Does SPLUNK have  document template in capturing Dashboard requirements from users?  Below points is request to the user .what they are looking for in a Dashboard.Is any other point to be add.need a sample template. 1. Identify stakeholders’ goals to suggest dashboard metrics ... 2. Take a questions-first approach ... 3. Understand how end users interact with the dashboard ... 4. Identify which KPIs are the most important ... 5. Create a step-by-step workflow ... 6. Collaborate on the dashboard layout in advance ... 7. Choose the dashboard type before creating it ... 8. Repurpose analyzed data to create useful dashboards ...   Thanks, Karthi ... View more
Labels

Re: Splunk dashboard performance Issue

by in Dashboards & Visualizations
‎02-23-2024 01:47 AM
‎02-23-2024 01:47 AM
@gcusello  Please find the exact query. index="Test" applicationName="sapi" timestamp log.map.correlationId level message ("Ondemand Started*" OR "Process star | rex field-message max_match=0 "\"Ondemand Started for. filename: (?<OnDemandFileName> [^\n]\w+\S+)" | rex field-message max_match=0 "Process started for (?<FileName>[^\n]+)" |eval OnDemandFileName=rtrim(OnDemandFileName, "Job") |eval "FileName/JobName"= coalesce (OnDemandFileName, FileName) | rename timestamp as Timestamp log.map.correlationId as CorrelationId level as Level message as Message |eval JobType=case (like( 'Message', "%Ondemand Started%"), "OnDemand", like('Message", "Process started%"), "Scheduled", true (), "Unknown") |eval Message=trim(Message, "\"") |table Timestamp CorrelationId Level JobType "FileName/JobName" Message join CorrelationId type=left [search index="Test" applicationName="sapi" level=ERROR | rename log.map.correlationId as CorrelationId level as Level message as Messagel | dedup CorrelationId | table CorrelationId Level Messagel] | table Timestamp CorrelationId Level JobType "FileName/JobName" Messagell join CorrelationId type=left [ search index="Test" applicationName="sapi" message="*file archived successfully *" | rex field-message max_match=0 "\"Concur file archived successfully for file name: (?<Archived FileName>[^\n]\w+\S+)" |eval Archived FileName=rtrim(Archived FileName,"\"") | rename log.map.correlationId as CorrelationId | table CorrelationId ArchivedFileName] | table Timestamp CorrelationId Level JobType "FileName/JobName" ArchivedFileName Messagel join CorrelationId type=left [ search index="Test" applicationName="sapi" (log.map.processor Path=ExpenseExtractProcessingtoOraclex AND (" Import*" OR "APL Import*")) | rename timestamp as Timestamp1 log.map.correlationId as CorrelationId level as Level message as Message | eval Status-case (like('Message", "%GL Import flow%"), "SUCCESS", like('Message", "%APL Import flow%"), "SUCCESS", like('Level', "%Exception%"), "ERROR") | rename Message as Response | table Timestamp1 CorrelationId Status Response] | eval Status=if (Level="ERROR", "ERROR", Status) | eval StartTime=round(strptime(Timestamp, "%Y-%m-%dT%H:%M: %S.%QZ")) | eval EndTime=round(strptime (Timestamp1, "%Y-%m-%dT%H:%M: %S.%QZ")) | eval Elapsed TimeInSecs-EndTime-StartTime | eval. "Total Elapsed Time"=strftime (Elapsed TimeInSecs, "%H:%M:%S") | eval Response= coalesce (Response, Message1)|table Status CorrelationId ArchivedFileName] | table Timestamp CorrelationId Level JobType "FileName/JobName" ArchivedFileName |search Status=* |stats count by JobType ... View more

Splunk dashboard performance Issue

by in Dashboards & Visualizations
‎02-22-2024 10:34 PM
‎02-22-2024 10:34 PM
Hi, I am writing a query in Splunk dashboard and the query return in base search it has multiple joint query. still the page is loading very slow. need to improve performance of dashboard query. This my the query. index="Test" applicationName="sapi" timestamp log.map.correlationId level message ("Ondemand Started*" OR "Process star | rex field-message max_match=0 "\"Ondemand Started for. filename: (?<OnDemandFileName> [^\n]\w+\S+)" | rex field-message max_match=0 "Process started for (?<FileName>[^\n]+)" Ieval OnDemandFileName=rtrim(OnDemandFileName, "Job") Ieval "FileName/JobName"= coalesce (OnDemandFileName, FileName) | rename timestamp as Timestamp log.map.correlationId as CorrelationId level as Level message as Message eval JobType=case (like( 'Message', "%Ondemand Started%"), "OnDemand", like('Message", "Process started%"), "Scheduled", true (), "Unknown") eval Message=trim(Message, "\"") table Timestamp CorrelationId Level JobType "FileName/JobName" Message join CorrelationId type=left [search index="Test" applicationName="sapi" level=ERROR | rename log.map.correlationId as CorrelationId level as Level message as Messagel I dedup CorrelationId | table CorrelationId Level Message1] | table Timestamp CorrelationId Level JobType "FileName/JobName" Messagel I join CorrelationId type=left 20 [ search index="Test" applicationName="sapi" message="*file archived successfully *" | rex field-message max_match=0 "\"Concur file archived successfully for file name: (?<Archived FileName>[^\n]\w+\S+)" Ieval Archived FileName=rtrim(Archived FileName,"\"") I rename log.map.correlationId as CorrelationId | table CorrelationId ArchivedFileName] 1 table Timestamp CorrelationId Level JobType "FileName/JobName" ArchivedFileName Message1 join CorrelationId type=left [ search index="Test" applicationName="sapi" (log.map.processor Path=ExpenseExtractProcessingtoOraclex AND (" Import*" OR "APL Import*")) | rename timestamp as Timestamp1 log.map.correlationId as CorrelationId level as Level message as Message | eval Status-case (like('Message", "%GL Import flow%"), "SUCCESS", like('Message", "%APL Import flow%"), "SUCCESS", like('Level', "%Exception%"), "ERROR") | rename Message as Response | table Timestamp1 CorrelationId Status Response] Ieval Status=if (Level="ERROR", "ERROR", Status) Ieval StartTime=round(strptime(Timestamp, "%Y-%m-%dT%H:%M: %S.%QZ")) | eval EndTime=round(strptime (Timestamp1, "%Y-%m-%dT%H:%M: %S.%QZ")) Ieval Elapsed TimeInSecs-EndTime-StartTime | eval. "Total Elapsed Time"=strftime (Elapsed TimeInSecs, "%H:%M:%S") eval Response= coalesce (Response, Message1)|table Status CorrelationId ArchivedFileName] 1 table Timestamp CorrelationId Level JobType "FileName/JobName" ArchivedFileName |search Status=*|stats count by JobType ... View more
Labels

Splunk Interview Question?

by in Splunk Enterprise
‎01-22-2024 09:06 PM
‎01-22-2024 09:06 PM
Hi All, I am new to splunk clustering environment and i have few questions when i attend interview.Any one please help me on this question 1.Can we delete index folder ?will we have permission to delete the index folder Splunk\var\lib\splunk\TestDB. 2.Can we copy the Index folder and paste it in someother index folder will be able to search the logs? 3.Where can we install DB connect app and other apps in Search head cluster OR Indexer Server cluster? 4.What is the process name when we extract logs from props and transform.conf file? 5.Upgrade Splunk cluster enironment with simple steps? 6.What is the process of search head captain will do ? Thanks, Karthigeyan R ... View more

How to extract json value fields?

by in Splunk Dev
‎01-12-2024 12:11 AM
‎01-12-2024 12:11 AM
"reqUser":"mhundi","evtTime":"2023-06-08 14:04:06.504","access":"SELECT","resource":"dsc60180_ici_sde_tz_db/vehicle_master/light_truck_lob_flag,lincoln_lob_flag,model_e_lob_flag,vehicle_make_desc,vehicle_type_desc,warranty_start_date,vehicle_type_desc,warranty_start_date","resType":"@column","action":"select","result":1,"agent":"hiveServer2","policy":101343,"enforcer":"ranger-acl","sess":"00ef27f9-75a4-4821-9e8a-60f16af6b962","cliType":"HIVESERVER2","cliIP":"19.51.78.185","reqData":"SELECT * FROM (SELECT `Left`.`advisor_name`, `Left`.`appointment_created_by`, `Left`.`appointment_datetime   Fields to be extract  reqUser, evtTime, resource     ... View more
Labels

What is ingestion in Splunk?

by in Alerting
‎11-27-2023 02:49 AM
‎11-27-2023 02:49 AM
Thanks in Advance. I had call from one company and they asked you have experience in Splunk Ingestion. I thought is data onboarding from GUI right? or something different? ... View more
Labels

Search sequence knowledge object in splunk?

by in Getting Data In
‎09-27-2023 12:58 AM
‎09-27-2023 12:58 AM
I had a interview question that what is search sequence of knowledge object in splunk.Please helpme regarding this,   ... View more
Labels

How extract field using rex?

by in Splunk Search
‎04-05-2023 10:00 PM
‎04-05-2023 10:00 PM
How to extract fields in between | servername | Which i am using in rex  ^[^\|\n]*\|(?P<Server>\w+\.\w+\.\w+\.\w+\s+) But its not extracting the all the servers 05-Apr-2023 04:42:44:PM: |IISN11WCRL02.nnp.anp.co.xx | Ping statistics for 10.10.10.194: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 54ms, Maximum = 54ms, Average = 54ms 4/5/23 4:42:41.000 AM 05-Apr-2023 04:42:41:PM: |IISN11WCRL02.nnp.anp.co.xx | Ping statistics for 10.10.10.194: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 54ms, Maximum = 57ms, Average = 54ms 4/5/23 4:42:38.000 AM 05-Apr-2023 04:42:38:PM: |IIISN11WCRL02.nnp.anp.co.xx | Ping statistics for 10.10.10.194: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 53ms, Maximum = 54ms, Average = 53ms 4/5/23 4:42:34.000 AM 05-Apr-2023 04:42:34:PM: |naz11sry001l | Ping statistics for 10.10.10.194: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 53ms, Maximum = 55ms, Average = 54ms 4/5/23 4:42:31.000 AM 05-Apr-2023 04:42:31:PM: |naz11sry002l | Ping statistics for 10.10.10.194: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 53ms, Maximum = 55ms, Average = 54ms ... View more
Labels

Re: How to map my query with inputlookup values?

by in Getting Data In
‎04-03-2023 10:38 PM
‎04-03-2023 10:38 PM
Thanks ... View more

How to map my query with inputlookup values?

by in Getting Data In
‎03-31-2023 06:30 AM
‎03-31-2023 06:30 AM
I am running script to get ping status of the servers and i onboarded the logs and extract filed as Servers.Now in my inputlookup i have 5 fields (ServerName,ApplicationName,Environment,Alias,IPAdress).So i need to map the query result with inputlookup. Index=* sourcetype=StatusPing |rex field=_raw "^[^\|\n]*\|\s+(?P<Servers>[^ ]+)" | eval Status=case(Lost=0, "UP", Lost=2, "Warning", Lost=4, "Down")|append [|inputlookup PingStatus.csv|rename Servers as ServerName ]|table Alias,EnvironmentName,ApplicationName,ServerName,IPAddress,Lost,Status Thanks in Advance ... View more
Labels

Re: How extract field and value using rex?

by in Splunk Search
‎03-30-2023 11:38 PM
‎03-30-2023 11:38 PM
@ITWhisperer  rex field=_raw "MemoryUsage %(?<MemoryUtilization>[^']+)" MY result is ------------ 41.4   expected result 41.4 ... View more

How extract field and value using rex?

by in Splunk Search
‎03-30-2023 07:39 PM
‎03-30-2023 07:39 PM
29-Mar-2023 04:56:35:PM: |CPU Utilization % Average ------- 11   Expected result: 11 ... View more
Labels

Re: How to read and extract table format logs in s...

by in Splunk Search
‎03-30-2023 12:00 AM
‎03-30-2023 12:00 AM
  Hi @gcusello This is my log file and i onboarded data in splunk   29-Mar-2023 04:56:34:PM: |Services Status in Server Status Name DisplayName ------ ---- ----------- Stopped ALG Application Layer Gateway Service Running Appinfo Application Information 29-Mar-2023 04:56:34:PM: |Application Disk Space utilization % DeviceID VolumeName FreeSpace (Gb) Total (Gb) FreePercent -------- ---------- -------------- ---------- ----------- C: System 389.45 475.14 81.97 P: Offline 389.45 475.14 81.97 29-Mar-2023 04:56:34:PM: |Application Running Process Status Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName ------- ------ ----- ----- ------ -- -- ----------- 1376 54 175332 238112 3,296.30 7516 4 Teams 9558 194 510488 458660 2,687.58 16488 4 OUTLOOK 926 47 46352 60284 1,959.77 2124 4 cptrayUI 1312 48 232896 175384 1,427.73 2684 4 msedge 3473 560 163948 282908 1,234.33 14368 4 msedge 29-Mar-2023 04:56:35:PM: |CPU Utilization % Average ------- 11 29-Mar-2023 04:56:36:PM: |Memory Utilization % MemoryUsage % ------------- 61.44 29-Mar-2023 04:56:36:PM: |Path Installed on System in Last 90 days Source Description HotFixID InstalledBy InstalledOn ------ ----------- -------- ----------- ----------- Update KB NT AUTHORITY\SYSTEM 16/02/2023 12:00:00 AM Security Update KB NT AUTHORITY\SYSTEM 23/03/2023 12:00:00 AM Update KB NT AUTHORITY\SYSTEM 23/03/2023 12:00:00 AM   ... View more

How to read and extract table format logs in Splun...

by in Splunk Search
‎03-29-2023 10:03 PM
‎03-29-2023 10:03 PM
Thanks in Advance, How to read and extract table format logs in splunk? And i need DeviceID as field and with values as  same for all fields   3/29/23 4:56:34.000 AM   29-Mar-2023 04:56:34:PM: |Application Disk Space utilization % DeviceID  VolumeName  FreeSpace (Gb)     Total (Gb)  FreePercent  --------        ----------             --------------                ----------         ----------- C:                System              389.45                         475.14               81.97 P:                Offline                389.45                         475.14               81.97   3/29/23 4:56:34.000 AM   29-Mar-2023 04:56:34:PM: |Services Status in Server Status         Name                   DisplayName     ------             ----                         ----------- Stopped     ALG                       Application Layer Gateway Service Running Running       Appinfo               Application Information     ... View more
Labels

Re: How to ping server using splunk without add-on...

by in Dashboards & Visualizations
‎03-16-2023 02:38 AM
‎03-16-2023 02:38 AM
Hi @gcusello   The script should place in which server is the splunk server or which i installed UF and i have access for the server. How to access my script which i placed in UF where i installed. ... View more

How to ping server using splunk without add-on app...

by in Dashboards & Visualizations
‎03-15-2023 11:08 PM
‎03-15-2023 11:08 PM
However we are trying to achive ping status in a dashboard .And also pingcommand app is not supported in splunk and we are not to use apps like network toolkit. How to ping server without using any apps.     ... View more
Labels

Splunk alert for multiple time?

by in Monitoring Splunk
‎02-22-2023 09:45 PM
‎02-22-2023 09:45 PM
Thanks in advance. We have scenario that we need to send alerts multiple times .   1. Lagging      E.g  Lets put Threshold time : 1 Hour   20/02 10:00 AM NZT : Lagging encountered after 1 Hour threshold -> Alert#1 via email with subject : Total lag time      20/02 11:00 AM NZT : Lagging still occur -> Alert#2 via email with subject : Total lag time   2 hour (Accumulated lagging hour) + Create Incidents in ServiceNow       20/02 13:00 PM NZT : Lagging encountered after 1 Hour threshold -> Alert#3 via email with subject : Total lag time      20/02 14:00 PM NZT : Lagging encountered after 1 Hour threshold -> Alert#4 via email with subject : Total lag time ---Got fixed   ... View more

How to find difference in JSON file as in given be...

by in Getting Data In
‎06-27-2022 08:19 PM
‎06-27-2022 08:19 PM
Hi, Thanks in advance Below events is in splunk .We have two repos in git 1. AAA 2.BBB.When ever the repos will replicate and both repos should be same file. But in my case after replicate both repos files are missing so i should compare the files and whare are the files is missing and send an alert as difference in repos. INTERESTING FIELDS: CODE.Modified_files{} TOOLKIT.Modified_files{}   Expected output after comparing: CODE.Modified_files{} "a/D:\\\\splunk_code_replication\\\\AAA_CODE/.git/logs/refs/heads/master", "a/D:\\\\splunk_code_replication\\\\AAA_CODE/.git/version.json" TOOLKIT.Modified_files{} "a/D:\\\\splunk_code_replication\\\\AAA_TOOLKIT/.git/logs/refs/heads/master" These files are only present in AAA repo but not in BBB. So we need compare both AAA and BBB missing files. As per the event and show the difference.         { "CODE": { "modified_files": [ "a/D:\\\\splunk_code_replication\\\\AAA_CODE/.git/HEAD", "a/D:\\\\splunk_code_replication\\\\AAA_CODE/.git/config", "a/D:\\\\splunk_code_replication\\\\BBB_CODE/.git/HEAD", "a/D:\\\\splunk_code_replication\\\\BBB_CODE/.git/config", "a/D:\\\\splunk_code_replication\\\\AAA_CODE/.git/logs/refs/heads/master", "a/D:\\\\splunk_code_replication\\\\AAA_CODE/.git/version.json" ] } } { "TOOlKIT": { "modified_files": [ "a/D:\\\\splunk_code_replication\\\\AAA_TOOLKIT/.git/HEAD", "a/D:\\\\splunk_code_replication\\\\AAA_TOOLKIT/.git/config", "a/D:\\\\splunk_code_replication\\\\BBB_TOOLKIT/.git/HEAD", "a/D:\\\\splunk_code_replication\\\\BBB_TOOLKIT/.git/config", "a/D:\\\\splunk_code_replication\\\\AAA_TOOLKIT/.git/logs/refs/heads/master", ] } }           ... View more

Re: Compare github repos using splunk?

by in Splunk Enterprise
‎06-27-2022 08:10 PM
‎06-27-2022 08:10 PM
How it will send the data automatically? ... View more

Re: Compare json file and find the difference in l...

by in Getting Data In
‎06-23-2022 12:52 AM
‎06-23-2022 12:52 AM
  { "CODE": { "modified_files": [ "a/D:\\\\splunk_code_replication\\\\AAA_CODE/.git/HEAD", "a/D:\\\\splunk_code_replication\\\\AAA_CODE/.git/config", "a/D:\\\\splunk_code_replication\\\\BBB_CODE/.git/index", "a/D:\\\\splunk_code_replication\\\\BBB_CODE/.git/config", "a/D:\\\\splunk_code_replication\\\\AAA_CODE/.git/logs/refs/heads/master", "a/D:\\\\splunk_code_replication\\\\AAA_CODE/.git/version.json" ] } } { "TOOlKIT": { "modified_files": [ "a/D:\\\\splunk_code_replication\\\\AAA_TOOLKIT/.git/HEAD", "a/D:\\\\splunk_code_replication\\\\AAA_TOOLKIT/.git/config", "a/D:\\\\splunk_code_replication\\\\BBB_TOOLKIT/.git/index", "a/D:\\\\splunk_code_replication\\\\BBB_TOOLKIT/.git/config", "a/D:\\\\splunk_code_replication\\\\AAA_TOOLKIT/.git/logs/refs/heads/master", ] } }   @richgalloway Above events is in splunk .We have two repos in git 1. AAA 2.BBB.When ever the repos will replicate and both repos should be same file. But in my case after replicate both repos files are missing so i should compare the files and whare are the files is missing and send an alert as difference in repos. INTERESTING FIELDS: CODE.Modified_files{} TOOLKIT.Modified_files{}   Expected output after comparing: CODE.Modified_files{} "a/D:\\\\splunk_code_replication\\\\AAA_CODE/.git/logs/refs/heads/master", "a/D:\\\\splunk_code_replication\\\\AAA_CODE/.git/version.json" These files are only present in AAA repo but not in BBB. So we need compare both AAA and BBB missing files. As per the event and show the difference.   ... View more

Re: Extracting Json file format as Fields using pr...

by in Splunk Search
‎06-14-2022 07:43 PM
‎06-14-2022 07:43 PM
@gcusello  Shared logs above. ... View more

Re: Extracting Json file format as Fields using pr...

by in Splunk Search
‎06-07-2022 03:29 AM
‎06-07-2022 03:29 AM
Hi @gcusello , Below the result of the json log file.   { "AAA": { "modified_files": [ "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_AAA/lu/.git/HEAD", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_AAA/lu/.git/config", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_AAA/lu/.git/index", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_AAA/lu/.git/logs/HEAD", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_AAA/lu/.git/logs/refs/heads/dev", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_AAA/lu/.git/logs/refs/heads/master", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_AAA/lu/.git/HEAD", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_AAA/lu/.git/idx", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_AAA/lu/.git/pack", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_AAA/lu/.git/refs/heads/dev", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_AAA/lu/.git/refs/heads/master", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_AAA/lu/.git/refs/remotes/origin/HEAD", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_AAA/lu/Database/2021.10_sql", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_AAA/lu/VisualStudio2005/WebService.sln", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_AAA/lu/VisualStudio2005/WebSite.sln", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_AAA/lu/Web/WebSite/lu.csproj", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_AAA/lu/Web/WebSite/Web.DEV.config", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_AAA/lu/Web/WebSite/Web.config", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_AAA/lu/Web/WebSite/Web.config", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_AAA/lu/Web/WebSite/Web..config", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_AAA/lu/Web/WebSite/Web.PP.config", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_AAA/lu/Web/WebSite/Web.config", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_AAA/lu/Web/WebSite/Web.QA.config", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_AAA/lu/Web/WebSite/Web.SIT.config" ] } }{ "BBB": { "modified_files": [ "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_BBB/ContinuousIntegration/.git/HEAD", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_BBB/ContinuousIntegration/.git/config", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_BBB/ContinuousIntegration/.git/index", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_BBB/ContinuousIntegration/.git/logs/HEAD", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_BBB/ContinuousIntegration/.git/logs/refs/heads/feature/new-server-updates", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_BBB/ContinuousIntegration/.git/logs/refs/heads/integration", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_BBB/ContinuousIntegration/.git/logs/refs/remotes/origin/HEAD", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_BBB/ContinuousIntegration/.git/objects/pack/pack-87d6b8ab05803d2bd514f956bb3ee97eb5db6d4d.idx", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_BBB/ContinuousIntegration/.git/objects/pack/pack-87d6b8ab05803d2bd514f956bb3ee97eb5db6d4d.pack", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_BBB/ContinuousIntegration/.git/refs/heads/feature/new-server-updates", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_BBB/ContinuousIntegration/.git/refs/heads/integration", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_BBB/ContinuousIntegration/.git/refs/remotes/origin/HEAD", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_BBB/ContinuousIntegration/BBB.Build/BBB.Build.psm1", ] } }{ "CCC": { "modified_files": [ "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_CCC/BLTS/.git/HEAD", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_CCC/BLTS/.git/config", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_CCC/BLTS/.git/index", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_CCC/BLTS/.git/logs/HEAD", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_CCC/BLTS/.git/logs/refs/heads/BLTSFix", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_CCC/BLTS/.git/logs/refs/heads/dev", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_CCC/BLTS/.git/logs/refs/remotes/origin/HEAD", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_CCC/BLTS/.git/objects/pack/pack-.idx", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_CCC/BLTS/.git/objects/pack/pack-1.pack", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_CCC/BLTS/.git/objects/pack/pack-f067c2bff747ce861.idx", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_CCC/BLTS/.git/packed-refs", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_CCC/BLTS/.git/refs/heads/BLTSFix", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_CCC/BLTS/.git/refs/heads/dev", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_CCC/BLTS/.git/refs/remotes/origin/HEAD", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_CCC/BLTS/.vscode/launch.json", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_CCC/BLTS/App/WebService/BltsService.csproj", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_CCC/BLTS/App/WebService/Dare.cs", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_CCC/BLTS/App/WebService/Web.$$OAT.config", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_CCC/BLTS/App/WebService/Web.config", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_CCC/BLTS/Database/2021.9_JIRA15219_ProductCodes/01_JIRA15219_ProductCodes_Backup.sql", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_CCC/BLTS/Database/2021.9_JIRA15219_ProductCodes/02_JIRA15219_BLTS_ProductCodes.sql", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_CCC/BLTS/Database/2021.9_JIRA15219_ProductCodes/JIRA15219_ProductCode_BackoutDBScript.sql", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_CCC/BLTS/Web/WebSite/Blts.csproj", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_CCC/BLTS/Web/WebSite/Web.$$OAT.config" ] } }{ "DDD": { "modified_files": [ "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/.git/HEAD", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/.git/config", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/.git/index", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/.git/logs/HEAD", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/.git/logs/refs/heads/BBB-11392_BU_$$Replication", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/.git/logs/refs/heads/dev", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/.git/logs/refs/remotes/origin/HEAD", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/.git/objects/pack/pack-f46eea35cf14742a81d21f669f667e4df3bdc2a6.idx", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/.git/objects/pack/pack-f46eea35cf14742a81d21f669f667e4df3bdc2a6.pack", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/.git/refs/heads/BBB-11392_BU_$$Replication", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/.git/refs/heads/dev", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/.git/refs/remotes/origin/HEAD", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/.gitignore", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Apps/BOController/Controller.cpp", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Apps/CollateralEngine/ZAddDAO.cpp", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Apps/RISSearch/SearchRis.cpp", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Apps/SoapComm/SoapGenerator.cpp", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Apps/binaries/duplicateaccounts.xsl", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Apps/binaries/selectedentities.xsl", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Apps/ccmspersist/XMLHelper.cpp", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Batch/CCMS-SSIS/BOExtract.dtsConfig", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Batch/CCMS-SSIS/CCMS-SSIS.database", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Batch/CCMS-SSIS/CCMS-SSIS.dtproj", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Batch/CCMS-SSIS/CCMS-SSIS.sln", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Batch/CCMS-SSIS/CCMS.APRA.Extract.Tables.xml", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Batch/CCMS-SSIS/CCMS.APRA.Extract.dtsConfig", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Batch/CCMS-SSIS/CCMS.APRA.Extract.dtsx", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Batch/CCMS-SSIS/CCMS.CHARM.Batch.DEV.dtsConfig", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Batch/CCMS-SSIS/CCMS.CHARM.Batch.NewDB.DEV.dtsConfig", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Batch/CCMS-SSIS/CCMS.CHARM.Extract.NewDB.dtsx", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Batch/CCMS-SSIS/CCMS.CHARM.Extract.dtsx", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Batch/CCMS-SSIS/CCMS.Data.Cleanse.DEV.dtsConfig", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Batch/CCMS-SSIS/CCMS.Data.Cleanse.dtsx", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Batch/CCMS-SSIS/CCMS.MasterData.Migration.DEV.dtsConfig", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Batch/CCMS-SSIS/CCMS.MasterData.Migration.dtsx", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Batch/CCMS-SSIS/CCMS.RSDS.Extract.Tables.xml", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Batch/CCMS-SSIS/CCMS.RSDS.Extract.dtsConfig", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Batch/CCMS-SSIS/CCMS.RSDS.Extract.dtsx", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Batch/CCMS-SSIS/CCMS.RefData.Migration.DEV.dtsConfig", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Batch/CCMS-SSIS/CCMS.RefData.Migration.dtsx", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Batch/CCMS-SSIS/CCMS_Cleanup.dtsx", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Batch/CCMS-SSIS/CCMS_CustomerRefresh.dtsx", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Batch/CCMS-SSIS/CCMS_Orion_AuditCertificate.dtsx", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Batch/CCMS-SSIS/CCMS_RIS_BOExtraction.dtsx", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Batch/CCMS-SSIS/CCMS_RIS_FOExtraction.dtsx", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Batch/CCMS-SSIS/CustRefresh.dtsConfig", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Batch/CCMS-SSIS/FOExtract.dtsConfig", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Batch/CCMS-SSIS/Project.params", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/CI/script/nant/ccms_app_registry_nzoat.xml", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/CI/script/nant/ccms_web_registry_nzoat.xml", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Database/2021.11_JIRA15401_BulkUpdate/01_JIRA15401_BulkUpdate_DBScript_Backup.sql", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Database/2021.11_JIRA15401_BulkUpdate/02_JIRA15401_BulkUpdate_DBScript.sql", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Database/R2021.2/BackoutScripts/1.DROP_viw_CCMS_To_Elastic.sql", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Database/R2021.2/BackoutScripts/pra_Rpt_ReportableEvents_ES_Backout.sql", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Database/R2021.2/ChangeScripts/1.CREATE_viw_CCMS_To_Elastic.sql", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_DDD/CCMS/Database/R2021.2/ChangeScripts/pra_Rpt_ReportableEvents_ES.sql" ] } }{ "EEE": { "modified_files": [ "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_EEE/BUPS/###.git/HEAD", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_EEE/BUPS/###.git/config", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_EEE/BUPS/###.git/index", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_EEE/BUPS/###.git/logs/HEAD", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_EEE/BUPS/.git/logs/refs/heads/BBB-15109_add_pk_tblOrgUnitBU", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_EEE/BUPS/###.git/logs/refs/heads/dev", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_EEE/BUPS/###.git/logs/refs/remotes/origin/HEAD", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_EEE/BUPS/###.", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_EEE/BUPS/###.", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_EEE/BUPS/.git/refs/heads/BBB-15109_add_pk_tblOrgUnitBU", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_EEE/BUPS/###.git/refs/heads/dev", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_EEE/BUPS/###.git/refs/remotes/origin/HEAD", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_EEE/BUPS/###App/WebService/BUPS.Service.csproj", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_EEE/BUPS/###App/WebService/Web.$$OAT.config", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_EEE/BUPS/###Web/Common/DropDownListExtd/DropDownListExtd.csproj", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_EEE/BUPS/###Web/Common/LoggingManager/LoggingManager.csproj", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_EEE/BUPS/###Web/Common/MasterPages/Control/MasterPages", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_EEE/BUPS/###", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_EEE/BUPS/###", "a/D:\\\\splunk_code_replication\\\\Repos\\\\Fri_Jun_3_17-34-04_2022\\\\$$_EEE/BUPS/###" ] } }   ... View more

Re: Extracting Json file format as Fields using pr...

by in Splunk Search
‎06-07-2022 12:58 AM
‎06-07-2022 12:58 AM
  { "AAA": { "modified_files": [ "a/D:\\\\splunk\\\\A / ui/.env", "a/D:\\\\splunk\\\\A / ui/.env.example", "a/D:\\\\splunk\\\\B / ui/.env", "a/D:\\\\splunk\\\\B / ui/.env.example" ] } }{ "BBB": { "modified_files": [ "a/D:\\\\splunk\\\\A / ui/.env", "a/D:\\\\splunk\\\\A / ui/.env.example", "a/D:\\\\splunk\\\\B / ui/.env", "a/D:\\\\splunk\\\\B / ui/.env.example" ] } }{ "CCC": { "modified_files": [ "a/D:\\\\splunk\\\\A / ui/.env", "a/D:\\\\splunk\\\\A / ui/.env.example", "a/D:\\\\splunk\\\\B / ui/.env", "a/D:\\\\splunk\\\\B / ui/.env.example" ] } }{ "DDD": { "modified_files": [ "a/D:\\\\splunk\\\\A / ui/.env", "a/D:\\\\splunk\\\\A / ui/.env.example", "a/D:\\\\splunk\\\\B / ui/.env", "a/D:\\\\splunk\\\\B / ui/.env.example" ] } }   ... View more
Contact Me
Online Status
Offline
Date Last Visited
39 seconds ago
Karma given to