hai Thanks  i have confused, i am using the query but not getting fields added. could you give complete  search  index=ivz_onboarding_css_autosys source=Autosyscss1 | eval NEW_START_TIME=strftime(LAST_START,"%Y/%m/%d %H:%M:%S") | eval NEW_END_TIME=strftime(LAST_END,"%Y/%m/%d %H:%M:%S") | eval NEW_NEXT_TIME=strftime(NEXT_START,"%Y/%m/%d %H:%M:%S") | lookup timezonelookupdefine TIMEZONE output offset | fieldformat STARTTIME = strftime(NEW_START_TIME + tonumber(offset), "%F %H:%M:%S (".TIMEZONE.")") | fieldformat ENDTIME = strftime(NEW_END_TIME + tonumber(offset), "%F %H:%M:%S (".TIMEZONE.")") | fieldformat NEXTTIME = strftime(NEW_NEXT_TIME + tonumber(offset), "%F %H:%M:%S (".TIMEZONE.")")     ... View more

hi i have added timezone for EST in lookup and doing search but its not creating new fields STARTTIME,ENDTIME ,NEXTTIME    index=ivz_onboarding_css_autosys source=Autosyscss1 | eval NEW_START_TIME=strftime(LAST_START,"%Y/%m/%d %H:%M:%S") | eval NEW_END_TIME=strftime(LAST_END,"%Y/%m/%d %H:%M:%S") | eval NEW_NEXT_TIME=strftime(NEXT_START,"%Y/%m/%d %H:%M:%S") | lookup timezonelookupdefine TIMEZONE output offset | fieldformat STARTTIME = strftime(NEW_START_TIME + tonumber(offset), "%F %H:%M:%S (".TIMEZONE.")") | fieldformat ENDTIME = strftime(NEW_END_TIME + tonumber(offset), "%F %H:%M:%S (".TIMEZONE.")") | fieldformat NEXTTIME = strftime(NEW_NEXT_TIME + tonumber(offset), "%F %H:%M:%S (".TIMEZONE.")") ... View more

Hai, i have updated the search but not getting new filelds created.   index=ivz_onboarding_css_autosys source=Autosyscss1 | lookup timezonelookupdefine TIMEZONE output offset | fieldformat STARTTIME = strftime(LAST_START + tonumber(offset), "%F %H:%M:%S (".TIMEZONE.")") | fieldformat ENDTIME = strftime(LAST_END + tonumber(offset), "%F %H:%M:%S (".TIMEZONE.")") | fieldformat NEXTTIME = strftime(NEXT_START + tonumber(offset), "%F %H:%M:%S (".TIMEZONE.")")   resulted event : 2022-12-12 03:26:06.881, JOID="119829", JOB_NAME="PNC-PMT-UI-DATA-CACHE-REFRESH-GMAG-FUNDS", JOB_GROUP="PMT", TIMEZONE="EST5EDT", RUN_NUM="403234100", NTRY="0", RUN_MACHINE=" ", STATUS_CODE="9", STATUS="ACTIVATED", LAST_START="0", LAST_END="1670579164", NEXT_START="1670585400", DATE_CONDITIONS="1", DAYS_OF_WEEK="mo,tu,we,th,fr", EXCLUDE_CALENDAR="EST-NYSE-HOLIDAYS", RUNTIME="1670579164", EXIT_CODE="-656" ... View more

Hai tried but getting error while using the search below. i guess automatic lookup is incorrect, can you tell me the input and output fields for automatic lookup   sourcetype=autosys_POC | lookup Timezone TIMEZONE output offset | fieldformat STARTTIME = strftime(LAST_START + tonumber(offset), "%F %H:%M:%S (".TIMEZONE.")") | fieldformat ENDTIME = strftime(LAST_END + tonumber(offset), "%F %H:%M:%S (".TIMEZONE.")") | fieldformat NEXTTIME = strftime(NEXT_START + tonumber(offset), "%F %H:%M:%S (".TIMEZONE.")")   Error in 'lookup' command: Could not construct lookup 'Timezone, TIMEZONE, output, offset'. See search.log The lookup table 'Timezone' does not exist or is not available. The search job has failed due to an error. You may be able view the job in the      ... View more

hi small query i have created lookup file and lookup definition while creating automatic lookup what should i keep for Lookup input fields and Lookup output field below is the query i was using and getting error sourcetype=autosys_POC | lookup timezone TIMEZONE output offset | foreach LAST_* NEXT_* | fieldformat STARTTIME = strftime(LAST_START + tonumber(offset), "%F %H:%M:%S (".TIMEZONE.")") ... View more

hi can you give me complete query as an example after lookup file creation ... View more

hai i didnt understand this.   can you tell me clearly ... View more

HI gcusello I am using below query to calculate if job started on time or not based on actual start time and job start time, the eval condition is not working as i am comparing the time with actual_start time with job start by time please help if job not started time not matching with actual time then it result is late and start time is equal to actual start time is the result will be on_time so how can i create these 2 fields based on these index=main sourcetype=TEST | eval Job_start_by=strftime(strptime(START_TIME,"%Y/%m/%d %H:%M:%S"),"%H:%M") | eval SLA=IF(Job_start_by="ACTUAL_START_TIME","1.ON-TIME",IF(Job_start_by>"ACTUAL_START_TIME","2.LATE") | table JOB_NAME,STATUS,START_TIME,END_TIME,DAYS_OF_WEEK,ACTUAL_START_TIME,RUNTIME,Job_start_by ... View more

Hi I am trying to calculate SLA breach based on the below job START_TIME and END_TIME need help on search query to get below scenario. in below job actual start time was 4:30 but it was started at 4:50   ... View more

still the same empty values for the field values ... View more

hai Thanks for your response. i am using below query but not getting field values for NEW_START_TIME index=main sourcetype=autosys_CRD |eval NEW_START_TIME=strftime(START_TIME,"%H:$M") | table JOB_NAME,STATUS,START_TIME,END_TIME,DAYS_OF_WEEK,ACTUAL_START_TIME,RUNTIME,NEW_START_TIME @gcusello ... View more

@gcusello can you help on this ... View more

its giving 0 results  but while it has data,how we can filter to list only services for a host  ... View more

Already extracted the fields host , service name ,description and status so i want to know how many services are down for a host.   ... View more

hi events as for unix services data for source type Unix:Service"     2:36:57.000 PM Wed Oct 26 09:36:57 CDT 2022 type=systemctl UNIT=systemd-readahead-done.service, LOADED=loaded, ACTIVE=inactive, SUB=dead, DESCRIPTION="Stop Read-Ahead Data Collection" host = usinfsmbcld100source = Unix:Servicesourcetype = Unix:Service 10/26/22 2:36:57.000 PM Wed Oct 26 09:36:57 CDT 2022 type=systemctl UNIT=systemd-readahead-collect.service, LOADED=loaded, ACTIVE=inactive, SUB=dead, DESCRIPTION="Collect Read-Ahead Data" host = usinfsmbcld100source = Unix:Servicesourcetype = Unix:Service 10/26/22 2:36:57.000 PM Wed Oct 26 09:36:57 CDT 2022 type=systemctl UNIT=systemd-modules-load.service, LOADED=loaded, ACTIVE=inactive, SUB=dead, DESCRIPTION="Load Kernel Modules" host = usinfsmbcld100source = Unix:Servicesourcetype = Unix:Service 10/26/22 2:36:57.000 PM Wed Oct 26 09:36:57 CDT 2022 type=systemctl UNIT=systemd-ask-password-plymouth.service, LOADED=loaded, ACTIVE=inactive, SUB=dead, DESCRIPTION="Forward Password Requests to Plymouth" host = usinfsmbcld100source = Unix:Servicesourcetype = Unix:Service 10/26/22 2:36:57.000 PM Wed Oct 26 09:36:57 CDT 2022 type=systemctl UNIT=rpc-statd-notify.service, LOADED=loaded, ACTIVE=inactive, SUB=dead, DESCRIPTION="Notify NFS peers of a restart" host = usinfsmbcld100source = Unix:Servicesourcetype = Unix:Service 10/26/22 2:36:57.000 PM Wed Oct 26 09:36:57 CDT 2022 type=systemctl UNIT=rhel-autorelabel.service, LOADED=loaded, ACTIVE=inactive, SUB=dead, DESCRIPTION="Relabel all filesystems, if necessary" host = usinfsmbcld100source = Unix:Servicesourcetype = Unix:Service 10/26/22 2:36:57.000 PM Wed Oct 26 09:36:57 CDT 2022 type=systemctl UNIT=rhel-autorelabel-mark.service, LOADED=loaded, ACTIVE=inactive, SUB=dead, DESCRIPTION="Mark the need to relabel after reboot" host = usinfsmbcld100source = Unix:Servicesourcetype = Unix:Service 10/26/22 2:36:57.000 PM Wed Oct 26 09:36:57 CDT 2022 type=systemctl UNIT=pxp-agent.service, LOADED=not-found, ACTIVE=inactive, SUB=dead, DESCRIPTION="pxp-agent.service" host = usinfsmbcld100source = Unix:Servicesourcetype = Unix:Service 10/26/22 2:36:57.000 PM Wed Oct 26 09:36:57 CDT 2022 type=systemctl UNIT=plymouth-quit-wait.service, LOADED=loaded, ACTIVE=inactive, SUB=dead, DESCRIPTION="Wait for Plymouth Boot Screen to Quit" host = usinfsmbcld100source = Unix:Servicesourcetype = Unix:Service ... View more

i am not getting anything while checking with this actually i want create a view as to check list of services in stopped state based on hostname ... View more