I have an requirement to add icons to the xml dashboard and need to change the icon based on the result. Something like the below image: Since, I don't have permissions to use javascript/jquery inside, I only need to use CSS and XML. Can anyone please help me to do it. ... View more

I have a Splunk log in JSON format as follows: {"SCMSplunkLog":{ "SCMSuccessLog":{ "payload":{ "sourceCount":0,"level":"INFO","duplicateCount":0,"successCount":0,"startTime":"2019-01-19 23:08:31","endTime":"2019-01-19 23:08:34","publishedCount":0 },"appName":"***","eventType":"***"}}} Now, I want to draw the line chart with the hourly average of publishedCount over starttime. I tried the below query, but it is not working: index=*** source=*** | search SCMSplunkLog.SCMSuccessLog.eventType="***"| sort -splunkLogId | eval runDate = SCMSplunkLog.SCMSuccessLog.payload.startTime |eval time=strptime(runDate, "%m-%d-%Y %H") | chart sum(publishedCount) as dailyAvg over time | stats avg(dailyAvg) as TREND | eval TREND=round(TREND)| strcat "TREND" ": " TREND TREND Can anyone please suggest to me the solution for it. ... View more

I have a log which looks like follows: ||pool-2-thread-1|| INFO com.tmobile.sfdc.reports.service.OpportunityService - OPPORTUNITY_JOB: List size: 41 ||pool-2-thread-1|| INFO com.tmobile.sfdc.reports.service.OpportunityService - OPPORTUNITY_JOB: List size: 140 I want to get the sum of the numbers(140+41+..), And I have tried the below query base search| rex field=_raw "List size\"\:\"(?<size>[^\"]+)" | stats sum(size) But it returns nothing. Can anyone please suggest me what am doing wrong. ... View more

I have a splunk log as follows: ...||pool-2-thread-1|| INFO com.tmobile.sfdc.reports.batch.writer.LeadItemWriter - LEAD_JOB: Batch insertion is successful for count 1000 and exiting method write()::LeadItemWriter ----||pool-2-thread-1|| INFO com.tmobile.sfdc.reports.batch.writer.LeadItemWriter - LEAD_JOB: Batch insertion is successful for count 197 and exiting method write()::LeadItemWriter ||pool-2-thread-1|| INFO com.tmobile.sfdc.reports.batch.writer.OrderItemWriter - ORDER_JOB: Batch insertion is successful for count 3860 and exiting method write()::OrderItemWriter ||pool-2-thread-1|| INFO com.tmobile.sfdc.reports.batch.writer.OrderItemWriter - ORDER_JOB: Batch insertion is successful for count 30 and exiting method write()::OrderItemWriter I need to get the total count by job type, So My result will be like ORDER_JOB LEAD_JOB ------------------------------------------ 3890 1197 Can anyone please help me to write the Splunk query for getting the above result? ... View more

I have a following splunk log 2018-03-13T06:28:23.543266+00:00 Commissions.development.loan*** 103a9[[APP/PROC/WEB/0]]: cf_foundation=px-*** cf_app_name=loan*** cf_app_id=**** cf_org_name=Commissions cf_org_id=***** cf_space_name=development cf_space_id=70344c05-60c9-437b-ab88-432a33101022 .source.s_cf_apps {"@timestamp":"2018-03-12T23:28:23.542-07:00","@version":1,"message":"class CreateLoanRequestPayload {\n createLoanRequest: class CreateLoanRequest {\n header: class Header {\n senderid: Test123\n channelid: channel123\n applicationid: NFS\n applicationuserid: user123\n sessionid: session123\n interactionid: intc123\n activityid: actv123\n workflowid: wf123\n timestamp: 2018-03-13T16:50:21.298Z\n storeid: store123\n dealercode: dealer123\n masterdealercode: MdealerCode123\n originatingSenderId: orgSID\n userid: user123\n }\n loans: class Loans {\n account: class LoansAccount {\n commonCustomerId: CC_ID\n accountType: Type123\n accountSubType: SubType123\n billingAddress: class BillingAddress {\n addressLine1: addr1\n addressLine2: addr2\n cityName: chennai\n stateCode: 61478\n zip: 600017\n zipExt: 600018\n optOut: opt_Out\n optOutReason: opt_Out_reason\n optOutType: opt_Out_type\n }\n accountNumber: acc123\n status: ReadyTest\n lastUpdateTime: 2018-03-13T16:50:21.298Z\n billCycleDay: 12\n paymentDueDay: 12\n primaryPlaceOfUseAddress: class PrimaryPlaceOfUseAddress {\n addressLine1: addr1\n addressLine2: addr2\n cityName: chennai\n stateCode: 61478\n zip: 600017\n zipExt: 600018\n optOut: opt_Out\n optOutReason: testStr123\n optOutType: opt_Out_type\n }\n eipIndicator: false\n daysInCurrentAccount: 12\n universalLineId: UNID123\n }\n accountNumber: acc123\n loanId: loan123\n oldLoanId: oLoan123\n currentLoanSystem: cLoan123\n commonCustomerId: CCID123\n balance: 1000.0\n phoneNumber: 9989898898\n fulfillmentType: FFType123\n transactionType: TType123\n returnAuthorizationType: RAType123\n promotions: [class Promotions {\n promotionId: PROMO123\n promotionAmount: 1000.0\n }]\n totalAmountFinanced: 3000.0\n totalNumberOfInstallments: 15\n nominalInterestRate: 1000.0\n annualPercentageRate: 100.0\n downPaymentAmount: 1000.0\n additionalDownPaymentAmount: 1000.0\n downPaymentDiscountAmount: 1000.0\n totalDownPaymentAmount: 1000.0\n recurringInstallmentAmount: 1000.0\n lastInstallmentAmount: 1000.0\n lastInstallmentDueDate: 2018-04-01\n remainingNumberOfInstallments: 12\n purchasedEquipment: class PurchasedEquipment {\n deviceId: DEV1234\n imei: imei123\n serialNumber: sNumber123\n deviceStatus: READYTEST\n sku: testStr123\n description: testStr123\n fullRetailPrice: 1000.0\n productType: TYPE01\n productSubType: SUBTYPE123\n salePrice: 1000.0\n }\n paymentSchedule: [class PaymentSchedule {\n paymentDueDate: 2018-04-01\n installmentNumber: 123\n paymentAmount: 1000.0\n }]\n returnedEquipment: class ReturnedEquipment {\n deviceId: dev123\n imei: imei123\n serialNumber: sNo123\n deviceStatus: ReadyTest\n sku: 3425127898\n deviceRecoveryType: RcType123\n tradeInAmount: 1000.0\n }\n effectiveStartDate: 2018-03-01\n effectiveEndDate: 2018-03-10\n financingModelType: MType123\n statusCode: 200\n remorseReturnNumberOfDays: 2\n originatingMasterDealerCode: O_MDCODE_123\n originatingSalesChannel: oSCHNL_123\n submissionStatus: READYTEST\n pendingFinancialTransactionStatus: READYTEST\n workFlowConditions: [BalanceTransferComplete, shipmentPending]\n agreementNumber: AGREE123\n clientWorkFlowType: TYPE123\n tradeInEligibility: false\n orderId: oID123\n documentSet: class DocumentSet {\n documents: [class Documents {\n documentId: doc123\n documentType: dType01\n }]\n }\n delayPayIndicator: false\n orderLocationState: stateFailed\n orderLocationCity: chennai\n shipToState: tamilnadu\n programType: Test\n sourceTransactionId: sTransID123\n sourceSubTransactionId: subsTransID123\n sourceTransactionTime: 2018-03-13T16:50:21.298Z\n freightCarrier: fCarrier123\n description: Testing_purpose\n serviceLevelCode: sLevel123\n shippingCharge: 200.0\n waiverIndicator: false\n taxExemptionIndicator: false\n eligibilities: [class Eligibilities {\n eligibilityType: elType1\n ineligibleReasons: [class IneligibleReasons {\n reasonCode: rc123\n }]\n }]\n payments: [class Payments {\n paymentAmount: 1000.0\n }]\n acceleratedAmount: amnt1000\n salesChannelId: sCID123\n userId: user1234\n previousLoanSystem: pLS123\n recurringChargeAmount: amnt1000.00\n transferQuoteId: quote123\n transferInitiatedDate: 2018-03-09\n transferAccountNumber: acc1234\n transferType: type01\n unbilledAmount: 1000.0\n crossDefaultIndicator: false\n syncPending: false\n activeDutyMilitaryFlag: false\n subStatusCode: testStr123\n activityType: testStr123\n activityDescription: testStr123\n activityTime: 2018-03-13T16:50:21.298Z\n currentBilledAmount: 1000.0\n shippingDiscountAmount: 1000.0\n shippingDiscountPercent: 1000.0\n shippingChargeCode: testStr123\n additionalPaymentAmount: 1000.0\n newBalance: 1000.0\n newRecurringInstallmentAmount: 1000.0\n newRemainingNumberOfInstallment: 12\n quoteDate: 2018-03-07\n customerCreditClass: testStr123\n writeOff: class WriteOff {\n code: testStr123\n description: testStr123\n effectiveTime: 2018-03-13T16:50:21.298Z\n }\n shippingDate: 2018-03-10T16:50:21.298Z\n trackingNumber: testStr123\n acceleratedDate: 2018-03-10\n paymentOverdueDays: 12\n pastDueIndicator: false\n }\n }\n}","logger_name":"com.tmobile.deep.scms.LoanProcessor","thread_name":"pool-1-thread-11","level":"INFO","level_value":20000,"APP_NAME":"loanProcessor_SCMS","eventID: ":"a36t4856-dc8a-4343-afb3-7o9166","eventType: ":"LoanWriteOffCompleted"} Now I want to get the value of sourceTransactionTime from the log, I used below queries to get it, index=cloudfoundry sourcetype=cloud*** "cf_foundation=px-npe01" cf_org_name="Commissions" cf_space_name=development cf_app_name="loan***"|rex field=_raw "sourceTransactionTime\:(?<sourceTransactionTime>[^\n]+)"|table sourceTransactionTime it returns 2018-03-13T16:50:21.298Z\n freightCarrier: fCarrier123\n description: Testing_purpose\n serviceLevelCode: sLevel123\n shippingCharge: 200.0\n waiverIndicator: false\n taxExemptionIndicator: false\n eligibilities: [class Eligibilities {\n eligibilityType: elType1\n ineligibleReasons: [class IneligibleReasons {\n reasonCode: rc123\n }]\n }]\n payments: [class Payments {\n paymentAmount: 1000.0\n }]\n acceleratedAmount: amnt1000\n salesChannelId: sCID123\n userId: user1234\n previousLoanSystem: pLS123\n recurringChargeAmount: amnt1000.00\n transferQuoteId: quote123\n transferInitiatedDate: 2018-03-09\n transferAccountNumber: acc1234\n transferType: type01\n unbilledAmount: 1000.0\n crossDefaultIndicator: false\n syncPending: false\n activeDutyMilitaryFlag: false\n subStatusCode: testStr123\n activityType: testStr123\n activityDescription: testStr123\n activityTime: 2018-03-13T16:50:21.298Z\n currentBilledAmount: 1000.0\n shippingDiscountAmount: 1000.0\n shippingDiscountPercent: 1000.0\n shippingChargeCode: testStr123\n additionalPaymentAmount: 1000.0\n newBalance: 1000.0\n newRecurringInstallmentAmount: 1000.0\n newRemainingNumberOfInstallment: 12\n quoteDate: 2018-03-07\n customerCreditClass: testStr123\n writeOff: class WriteOff {\n code: testStr123\n description: testStr123\n effectiveTime: 2018-03-13T16:50:21.298Z\n }\n shippingDate: 2018-03-10T16:50:21.298Z\n trackingNumber: testStr123\n acceleratedDate: 2018-03-10\n paymentOverdueDays: 12\n pastDueIndicator: false\n }\n }\n}","logger_name":"com.tmobile.deep.scms.LoanProcessor","thread_name":"pool-1-thread-5","level":"INFO","level_value":20000,"APP_NAME":"loanProcessor_SCMS","eventID: ":"a1234e54-dc5a-4d23-afb3-oif16","eventType: ":"LoanVoidOrderCanceledCompleted"} But I want only the date value "2018-03-13T16:50:21.298Z". Can anyone please suggest me what am doing wrong. ... View more

I am having the field "transactionid" in the splunk log as follows: ***** "thread_name":"pool-2-thread-13","level":"ERROR","level_value":40000,"stack_trace":"com.fasterxml.jackson.databind.exc.InvalidFormatException: Can not deserialize value of type java.time.Instant from String \"test\": Text 'test' could not be parsed at index 0\n at [Source: {\"commisionEvent\":{\"channel\":\"testString\",\"orderType\":\"testString\",\"eventSource\":\"testString\",\"eventCreationDate\":\"2018-02-10T00:30:21.298Z\",\"orderDate\":\"2018-02-10T00:30:21.298Z\",\"dealerCode\":\"testString\",\"ban\":\"123\",\"orderNo\":\"testString\",\"originalOrderNo\":\"testString\",\"customerName\":\"testString\",\"msisdn\":\"testString\",\"orderDetails\":[{\"sku\":\"testString\",\"imei\":\"testString\",\"msisdnLineLevel\":\"testString\",\"msrp\":\"1000.00\",\"customerPaidAmount\":\"1200.00\",\"sellingPrice\":\"1000.00\",\"jumpIndicator\":\"testString\",\"eipIndicator\":\"123\",\"eip1stPayment\":\"1100.00\",\"eipPlanId\":\"testString\",\"eipInitialAmount\":\"1000.00\",\"discount\":\"100.00\",\"transactionid\":\"testString\",\"shippedDate\":\"test\",\"priceoverrideamount\":\"1000.00\",\"priceOverrideCode\":\"testString\",\"overrideReason\":\"testString\",\"originalTransactionId\":\"testString\",\"lineType\":\"testString\",\"transactionType\":\"testString\"}]}}; line: 1, column: 676] (through reference chain: com.tmobile.tfb.commissions.model.TbcUpgradesFeedPayload[\"commisionEvent\"]-com.fasterxml.jackson.datatype.jsr310.deser.InstantDeserializer.deserialize(InstantDeserializer.java:206)\n\t... 90 common frames omitted\n","APP_NAME":"tfb_hardGoods_SCMS","eventID: ":"123","eventType: ":"TBCCommissionUpgradeOrderFeed"} I tried the below query index=**** sourcetype=*"cf_foundation=" "cf_org_name=" "cf_space_name=Test-" "cf_app_name=***-test" | rex field=_raw ".*transactionid\\":\\"(?[^]+)"|table transactionid but it shows the error "Error in 'rex' command: Encountered the following error while compiling the regex '.*transactionid\":\"(?[^]+)': Regex: missing terminating ] for character class" Can anyone please suggest me the correct solutions for it. ... View more

I have splunk log as follows: 2018-02-21T18:29:31.958125+00:00 EQM-SCMS.Test-SCMS-qlab02.tfbhardGoodsSCMS-test fa4cbb7b-26fa-425e-968d-05dabde7c79a[[APP/PROC/WEB/0]]: cf_foundation=px-npe01 cf_app_name=tfb_hardGoods_SCMS-test cf_app_id=fa4cbb7b-26fa-425e-968d-05dabde7c79a cf_org_name=EQM-SCMS cf_org_id=56f5bed9-cbdc-4ae3-a1e8-73072442a1fe cf_space_name=Test-SCMS-qlab02 cf_space_id=ba8816e1-36d0-4857-9396-87dbf162aead .source.s_cf_apps {"@timestamp":"2018-02-21T10:29:31.957-08:00","@version":1,"message":"Acknowledging Message for consumerTag : cb6ba2fe-dc20-42e4-88ae-b94d3f17f611, deliveryTag : 32","logger_name":"com.tmobile.deep.AMQPEventConsumer","thread_name":"pool-2-thread-4","level":"INFO","level_value":20000,"APP_NAME":"tfb_hardGoods_SCMS","eventID: ":"d100ecb2-5821-4089-b8aa-902c0a8629a0","eventType: ":"TBCCommissionUpgradeOrderFeed"} 2018-02-21T18:19:58.059358+00:00 EQM-SCMS.Test-SCMS-qlab02.tfbhardGoodsSCMS-test fa4cbb7b-26fa-425e-968d-05dabde7c79a[[APP/PROC/WEB/0]]: cf_foundation=px-npe01 cf_app_name=tfb_hardGoods_SCMS-test cf_app_id=fa4cbb7b-26fa-425e-968d-05dabde7c79a cf_org_name=EQM-SCMS cf_org_id=56f5bed9-cbdc-4ae3-a1e8-73072442a1fe cf_space_name=Test-SCMS-qlab02 cf_space_id=ba8816e1-36d0-4857-9396-87dbf162aead .source.s_cf_apps {"@timestamp":"2018-02-21T10:19:58.059-08:00","@version":1,"message":"Before publishing the Event to Kafka:::LoggingHeader [eventType=TBCCommissionUpgradeOrderFeed, clientEventId=null, deepEventId=d2afaee0-1733-11e8-a03a-a96c3fa64a03, eventTime=03-21-2018 10:19:57, eventProducerId=TBC, filteredSystemsList=null, filteredExceptionMessage=null]","logger_name":"com.tmobile.deep.AMQPEventConsumer","thread_name":"pool-2-thread-3","level":"INFO","level_value":20000,"APP_NAME":"tfb_hardGoods_SCMS","eventID: ":"ca2f9346-ac31-465f-b306-11beb2543f52","eventType: ":"TBCCommissionUpgradeOrderFeed"} 2018-02-20T20:48:39.782740+00:00 EQM-SCMS.Test-SCMS-qlab02.tfbhardGoodsSCMS-test fa4cbb7b-26fa-425e-968d-05dabde7c79a[[APP/PROC/WEB/0]]: cf_foundation=px-npe01 cf_app_name=tfb_hardGoods_SCMS-test cf_app_id=fa4cbb7b-26fa-425e-968d-05dabde7c79a cf_org_name=EQM-SCMS cf_org_id=56f5bed9-cbdc-4ae3-a1e8-73072442a1fe cf_space_name=Test-SCMS-qlab02 cf_space_id=ba8816e1-36d0-4857-9396-87dbf162aead .source.s_cf_apps {"@timestamp":"2018-02-20T12:48:39.782-08:00","@version":1,"message":"Event with id : Snehal45678 , will be redelivered after 731757 ms from now ","logger_name":"com.tmobile.deep.AMQPWaitExchangePublisher","thread_name":"pool-2-thread-3","level":"INFO","level_value":20000,"APP_NAME":"tfb_hardGoods_SCMS","eventID: ":"Snehal45678","eventType: ":"TBCCommissionUpgradeOrderFeed"} Now I want to get the unique events ID , I have tried the query: index=cloudfoundry sourcetype=cloudfoundry_apps "cf_foundation=***" "cf_org_name=testOrg" "cf_space_name=Test" "cf_app_name=app-test" | stats count by eventID: But it returns nothing. Can anyone please help me to get it. ... View more