What appears to be happening is the timestamp fields can vary in length and appearance; so when we attempt to use the extractor to create as field that is past one of those varying timestamps we get unmatched rows in the extractor. ... View more

` 000 2 00 0000 2020-01-08 13:52:48.771 (PickupStatusListener:41) Message payload: <?xml version="1.0" encoding="UTF-8"?> <ns0:PickupStatus xmlns:ns0="http://cpc.ground.fedex.com/pickup/status/v1"><CorrelationId>4dba36a5-076b-4dc6-bde5-04366a4dcb78</CorrelationId><MessageId>bf6cd527-fb0b-4f08-8920-f1c01d498764</MessageId><ParentMessageId>c4b3cc79-c4bb-4512-a3b7-f1527cf03491</ParentMessageId><StatusForMessageId>1570a3c5-fab3-4ad3-ad13-5ed883171712</StatusForMessageId><DateTime>2020-01-08T13:52:48.717-05:00</DateTime><SourceSentDateTime>2020-01-08T13:52:27-05:00</SourceSentDateTime><Status>ReadReceipt</Status><Message>Request to remove pickup from manifest was received by the scanner.</Message><UserId>BRK_APP</UserId><RequestType>TransferRequest</RequestType><Action>Remove</Action><TerminalNumber>314</TerminalNumber></ns0:PickupStatus> ` ... View more

Thanks Rich! I will remember that!! Here is the log row.... 000 2 00 0000 2020-01-08 13:52:48.771 (PickupStatusListener:41) Message payload: <?xml version="1.0" encoding="UTF-8"?> <ns0:PickupStatus xmlns:ns0="http://cpc.ground.fedex.com/pickup/status/v1"><CorrelationId>4dba36a5-076b-4dc6-bde5-04366a4dcb78</CorrelationId><MessageId>bf6cd527-fb0b-4f08-8920-f1c01d498764</MessageId><ParentMessageId>c4b3cc79-c4bb-4512-a3b7-f1527cf03491</ParentMessageId><StatusForMessageId>1570a3c5-fab3-4ad3-ad13-5ed883171712</StatusForMessageId><DateTime>2020-01-08T13:52:48.717-05:00</DateTime><SourceSentDateTime>2020-01-08T13:52:27-05:00</SourceSentDateTime><Status>ReadReceipt</Status><Message>Request to remove pickup from manifest was received by the scanner.</Message><UserId>BRK_APP</UserId><RequestType>TransferRequest</RequestType><Action>Remove</Action><TerminalNumber>314</TerminalNumber></ns0:PickupStatus> ... View more

For some reason when I copy / paste the log row this field strips out my xml tags. Also when I try to upload a small image of the log row this site tells me I do not have enough points to upload the file. Therefore this site and any interaction thru the SPLUNK provided field for pasting data is virtually worthless! Is there any other way I can get this log row to you? ... View more

Is there ANY OTHER way I can get this image of the log row to you? ... View more

For some reason when I copy / paste the log row this field strips out my xml tags. Also when I try to upload a small image of the log row this site tells me I do not have enough points to upload the file. Therefore this site and any interaction thru the SPLUNK provided field for pasting data is virtually worthless! ... View more

I am unable to upload an image of this log row - AND - when I copy and paste the text of the log row it strips out my xml tags. How else can I get the text or an image of this log row to you. For some reason they say I do not have enough "points" to upload a small image of the log row. ... View more

Log row.... 000 2 00 0000 2020-01-08 13:52:48.771 (PickupStatusListener:41) Message payload: 4dba36a5-076b-4dc6-bde5-04366a4dcb78bf6cd527-fb0b-4f08-8920-f1c01d498764c4b3cc79-c4bb-4512-a3b7-f1527cf034911570a3c5-fab3-4ad3-ad13-5ed8831717122020-01-08T13:52:48.717-05:002020-01-08T13:52:27-05:00ReadReceiptRequest to remove pickup from manifest was received by the scanner.BRK_APPTransferRequestRemove314 Props.conf for sourcetype... -bash-4.2$ cat props.conf [kedex:cpc:log] SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+)\d{3}\s+\d{1}\s+\d{2}\s+\d{4} NO_BINARY_CHECK=true disabled=false TIME_PREFIX=\s+\d{4}\s+ TIME_FORMAT=%F %T.%3N TRUNCATE=999999 MAX_TIMESTAMP_LOOKAHEAD=35 [kedex:cpc:gc] SHOULD_LINEMERGE=false TIME_PREFIX=^ LINE_BREAKER=([\r\n]+)\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2} TIME_FORMAT=%FT%T.%3N MAX_TIMESTAMP_LOOKAHEAD=25 TRUNCATE=999999 [kedex:cpc:error] SHOULD_LINEMERGE=false TIME_PREFIX=^\d+\s+\d+\s+\d+\s+\d+\s+ LINE_BREAKER=([\r\n]+)\d+\s+\d+\s+\d+\s+\d+\s+\d{4}-\d{2}-\d{2} TIME_FORMAT=%F %T.%3N MAX_TIMESTAMP_LOOKAHEAD=25 TRUNCATE=999999 ... View more

Hi Rich - I will send it first thing tomorrow morning. Thank you for your attention to my question. Tim ... View more

Woocock! You're a Splunk Ninja and a genius too! Thank you so much. Solved my issue and your SPL contruct has taught me a good deal. 🙂 Below is the actual data I used - ingesting on 2 different days! •••••••••••••••••••••••••••••••••••••••••••• Day 1 --- FnameLname,JobTitle,IngestDate tim ham,driver,05-08-2019 tom hem,driver,05-08-2019 tod harm,driver,05-08-2019 jim slump,driver,05-08-2019 john hill,driver,05-08-2019 fill billy,driver,05-08-2019 slim pickins,driver,05-08-2019 jill hill,driver,05-08-2019 betty mids,driver,05-08-2019 rich farm,driver,05-08-2019 •••••••••••••••••••••••••••••••••••••••••••• Day 2 FnameLname,JobTitle,IngestDate tim ham,driver,05-09-2019 tom hem,fast-driver,05-09-2019 tod harm,driver,05-09-2019 jim slump,driver,05-09-2019 rick hull,driver,05-09-2019 fill billy,slow-driver,05-09-2019 slim pickins,driver,05-09-2019 jill hill,driver,05-09-2019 betty mids,driver,05-09-2019 rich farm,driver,05-09-2019 lacey underalls,farm-driver,05-09-2019 •••••••••••••••••••••••••••••••••••••••••••• Your modified SPL (Works Great!) index="table4work_all" ((earliest=-1d@d latest=@d-1) OR (earliest=@d)) | bin _time span=1d | stats dc(_time) AS timeCount values(_time) AS times dc(JobTitle) AS JobCount values(JobTitle) AS JobTitles BY FnameLname | multireport [ where timeCount==1 AND times >= relative_time(now(), "@d") | eval type = "hired"] [ where timeCount==1 AND times < relative_time(now(), "@d") | eval type = "fired"] [ where JobCount>1 | eval type = "changed"] Thank you! ... View more

Thank you Woodcock for your quick answer! I am going to try this and see if it works. I will thumbs up you when done. 🙂 ... View more

Hello Koshyk - Thank you for answering. 🙂 See sample csv type data I put together quickly below; you can copy the small table and paste into Notetab as a .txt type and then ingest. Its not big but can be used to prove that your SPL works. ---------- Begin table tim ham,driver,05-08-2019 tom hem,driver,05-08-2019 tod harm,driver,05-08-2019 jim slump,driver,05-08-2019 john hill,driver,05-08-2019 fill billy,driver,05-08-2019 slim pickins,driver,05-08-2019 jill hill,driver,05-08-2019 betty mids,driver,05-08-2019 rich farm,driver,05-08-2019 tim ham,driver,05-09-2019 tom hem,fast-driver,05-09-2019 tod harm,driver,05-09-2019 jim slump,driver,05-09-2019 rick hull,driver,05-09-2019 fill billy,slow-driver,05-09-2019 slim pickins,driver,05-09-2019 jill hill,driver,05-09-2019 betty mids,driver,05-09-2019 rich farm,driver,05-09-2019 lacey underalls,farm-driver,05-09-2019 ---------- End table ... View more

Hey deepashri_123 - I tried entering this one below; naturally with my fields and it did not work - it just shows a count = 0. index=index1 OR index=index2 | rename item2 as item1 | stats count dc(index) AS dc by item1 | where dc>1 | stats count . Any other suggestions? I continue to try different approaches. ... View more

Hey deepashri_123 - What if there is possibility of duplicates in Index1 of the Item1 and possibility of duplicates in Index2 of Item2? I want to be sure that Index1.Item1 is actually present in Index2.Item2. ... View more

Absolutely!! Thanks again. I'm new to this and I am upvoting it now. ... View more

This looks like it should work & thank you for your answers. I was not sure how to pass the timezone, however your answer is very illustrative and I appreciate it. ... View more

Can anyone show me an example? Should I append the TimeZone code "EST" or "CST" or "PST" as the suffix on the TIMESTAMP I am using STRPTIME to convert? ... View more