About benji00

benji00 · ‎09-10-2019

Hello all, I receiving some event from our Monitoring Agent tool (from the editor Dassault Systemes) through Common Base Event format like: <extendedDataElements name="status" type="string"> <values>0</values> </extendedDataElements> <extendedDataElements name="elapsed" type="string"> <values>203</values> </extendedDataElements> <extendedDataElements name="_period" type="string"> <values>300</values> </extendedDataElements> <extendedDataElements name="connection" type="string"> <values>47</values> </extendedDataElements> <extendedDataElements name="logoutTime" type="string"> <values>62</values> </extendedDataElements> <extendedDataElements name="getLoginPageTime" type="string"> <values>78</values> </extendedDataElements> <sourceComponentId componentType="ProductName" instanceId="3dpassport_TEST1" component="serviceHealthCheck" processId="" locationType="Hostname" location="io-ws-3de71ts" subComponent="" componentIdType="ProductName"/> <situation categoryName="ReportSituation"> <situationType reportCategory="LOG" xsi:type="ReportSituation" reasoningScope="INTERNAL"/> </situation> </CommonBaseEvent> I don't really understand how can I operate for example the "ELAPSED" extended elements and moreover be able to track his value evolution Any clue on your side?

benji00 · ‎07-12-2019

Thanks... it is working as expected (y)

benji00 · ‎07-11-2019

@renjith.nair, OK but then how can I call my filtered out field? Because at the end I want to use it to calculate a difference with another sub-process execution time (already conatining only numbers)...

benji00 · ‎07-11-2019

Hello, I have a field containing an execution time looking like: 100s and which is corresponding to 100 seconds. The field is only in second, so my concern is only to remove the final S to have a field with only numbers, any idea about how to do? Regards,

benji00 · ‎03-13-2019

Hello @nickhillscpl, Thanks for you feedback. Yes finally I used the extractong fields mode by using delimiters and it is working correctly. Not sure if it is the most efficient way but it is working. Your way seems quite clean... why do you say it is a dirty way ? Anyway I am going to accept your comment.

benji00 · ‎03-12-2019

Hello, When searching through Splunk the following request: index=3dexperience host=io-ws-3de*pr COMPLETE_QUERY I am receiving events as written below: 2019-03-12 08:32:40.629 | [http-nio-8094-exec-4] | DEBUG | c.d.federated_search.utils.Log | | | | [577] ##### [TIMER][CVServlet][COMPLETE_QUERY][113][ms] ##### 2019-03-12 08:27:09.782 | [http-nio-8094-exec-6] | DEBUG | c.d.federated_search.utils.Log | | | | [444] ##### [TIMER][CVServlet][COMPLETE_QUERY][118][ms] ##### My final objective is to have a timechart of the COMPLET_QUERY execution time in ms with the content of the next [] after the [COMPLETE_QUERY] one. Any idea? How to know if the log is a known format? I am currently trying by extracting new fields and using delimiters...

benji00 · ‎03-01-2019

OK @richgalloway, I will try to find on my own. Thanks again

benji00 · ‎03-01-2019

That's exasperating how easy is the request compared to the time to turn around it 🙂 Anyway @richgalloway thanks very much. Last precision: - I set the span to 1h as by default if Time Range is "Last 7 Days" it is set to 1 day - So sometimes I have many occurences in the same span (in this case I would like to do an average of all the values) and sometimes I have no values (in this case I would like to hide the results in the timechart if possible). Any idea?

benji00 · ‎03-01-2019

Hello, I would like to monitor my TomEE restart occurences and time execution, so I am looking for the expression: "Server startup in" and I am receiving the following events: 27-Feb-2019 14:12:05.781 INFO [main] sun.reflect.DelegatingMethodAccessorImpl.invoke Server startup in 4281 ms 25-Feb-2019 07:07:18.976 INFO [main] sun.reflect.DelegatingMethodAccessorImpl.invoke Server startup in 58057 ms 25-Feb-2019 07:07:18.976 INFO [main] sun.reflect.DelegatingMethodAccessorImpl.invoke Server startup in 58057 ms 23-Feb-2019 02:00:56.253 INFO [main] sun.reflect.DelegatingMethodAccessorImpl.invoke Server startup in 289897 ms How can I chart those times in ms ? Regards

benji00 · ‎03-01-2019

@tiagofbmm: Finally i succeeded to do this yesterday: rex field=_raw "(? .)\s=\s(? . )\s;\s(? .*)" | timechart eval(sum(vmql)-sum(vindex)) by vtype It is quite good but now I would like to add a filter in my query to say: if sum(vmql)-sum(vindex) >= 0 then don't show the results

benji00 · ‎03-01-2019

Hello, Thanks for you feedback and sorry for my no-answer. Your request is not so clear to me. Each morning I am running a DB script which will generate a log file containing in txt format, following information: TYPE;INDEX_COUNT;DB_COUNT Each day and for each type of course the counts will change. I want to be able to track the count evolution by type and by time. But I don't want to fill in myself the figures in a query as shown above. I want a Splunk query able to extract those figures by itself. Thanks

benji00 · ‎03-01-2019

Hello, Thanks for you feedback and sorry for my no-answer. Your request is not so clear to me. Each morning I am running a DB script which will generate a log file containing in txt format, following information: TYPE;INDEX_COUNT;DB_COUNT Each day and for each type of course the counts will change. I want to be able to track the count evolution by type and by time. But I don't want to fill in myself the figures in a query as shown above. I want a Splunk query able to extract those figures by itself. Thanks,Hello, Thanks very much for your answer and sorry but I tried to understand it and finally was worried by another topics. Anyway, what I don't understand in your answer is that the values are, let's say, hardcoded. From my side, each morning I will run a DB query which will generate a log file. This log file will contain the sample explained below: TYPE = INDEX_COUNT ; DB_COUNT CATMpgReference = 26357 ; 374819 VPMReference = 26210 ; 345331 But those values will change each day and my objective is to generate directly a chart showing this evolution, but without filling myself the values in a query as given above. I will try it again. Thanks

benji00 · ‎02-26-2019

Hello community, My first and probably not the last comment here...as it seems the community is quite active. I am currently launching an automated task that is by environment generating a log file giving me the difference between my objects in DB and my objects in my indexation. The file is composed as it is written below: **TYPE = INDEX_COUNT ; DB_COUNT CATMpgReference = 26357 ; 374819 VPMReference = 26210 ; 345331** By environment and type, I want to be able to have a line chart visualization of: DB_COUNT time evolution, DB_COUNT, INDEX_COUNT difference time evolution, DB_COUNT, INDEX_COUNT difference current status, I used the rex field=_raw "(?<vtype>.*)\s=\s(?<vindex>.*)\s;\s(?<vmql>.*)" | dedup vtype syntax to isolate the data, but I am unable to pass the visualization step. Any help please?

Posts	13
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎02-26-2019

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

CommonBaseEvent treatment

event with time record

Query execution time

chart for startup time

Can you help me with DB/Index app monitoring?

CommonBaseEvent treatment

Re: event with time record

Re: event with time record

event with time record

Re: Query execution time

Query execution time

Re: chart for startup time

Re: chart for startup time

chart for startup time

Re: Can you help me with DB/Index app monitoring?

Re: Can you help me with DB/Index app monitoring?

Re: Can you help me with DB/Index app monitoring?

Can you help me with DB/Index app monitoring?