Hi @gcusello  I agree that point but our client is not intrested to install agent and as you mentioned the syslog the application team have multiple logs .So is there any ways to monitor the logs .And how to onboard syslogs any examples.   Thanks, Karthi ... View more

Thanks for the brief  explanation. ... View more

Hi @bowesmana  My actual  requirement is that if the field with empty values then I dont want to show in the table.IF some of the correlationID we dont have ImpconID so i used above query to filter the empty values. Now i want to filter the null values from the field. PFA ... View more

Hi @bowesmana  Still the null field values is appearing. ... View more

Thanks, Provided query which i am trying to do. ... View more

index=mulesoft applicationName=test | stats values(content.payload.requestID) as Request1 values(content.payload.impConReqId) as ImpConReqId values(content.payload.batchId) as batch1 values(content.payload{}.batchId) as batch2 values(content.payload{}.impConReqId) as impConReqId1 values(content.payload.OutputParameters.X_REQUEST_ID ) as Request2 BY applicationName,correlationId | eval ImpConReqID= coalesce(ImpConReqId,impConReqId1) | eval RequestId= coalesce(Request1,Request2) | eval batchId= coalesce(batch1,batch2) | eval ImpCon=mvmap(ImpConReqID,if(match(ImpConReqID,".+"),"ImpConReqID: ".ImpConReqID,null())) | eval batch=mvmap(batchId,if(match(batchId,".+"),"batchId: ".batchId,null())) | eval ReqId=mvmap(RequestId,if(match(RequestId,".+"),"RequestId: ".RequestId,null())) | eval oracle=mvappend(ImpCon,batch,ReqId) | eval orcaleid=mvfilter(isnotnull(oracle)) | eval OracleResponse=mvjoin(orcaleid," ") | rename applicationName as ApplicationName correlationId as CorrelationId | table ApplicationName OracleResponse CorrelationId This the query which i am trying to get batchID, requestID, ImpconID.If the field value contains then i need to show in the table based on correlationID. Right now I am getting values properly. But in some scenario for the particular correlationID we have two or three ImpconIDwith values and with null values. So i want filter that null value ImpconId in the table .     ... View more

Hi @gcusello  Thanks for the reply. Actually i want to improve my dashboard performance. So i try to convert as report. But as you said its static. So if i use summary index or data model we can pass token ?any sample data model .And both will consume license right? ... View more

Hi @gcusello  Got it thanks , I dint defined in lookup definition. Now its mapping .One more thing i just want to add table name as URL in that it will shows Click here. Inside that I need to map the URL. ... View more

Yes i copy pasted the same payLoadInterface  into csv file.But i dont know why is not coming .And how to check the values from lookup file is getting populated The values like DSR_TEST,DSR_TEST1,DSR_TEST2 ... View more

Hi @gcusello  This my lookup InterfaceName Link DSR_TEST https://docs.splunk.com/Documentation/Splunk/9.2.1/SearchReference/Lookup?_gl=1*1w7wkaf*_ga*MTYzMTg2Njc5NC4xNzExOTgxMTg4*_ga_GS7YF8S63Y*MTcxNjM4NTE1Ni41OS4xLjE3MTYzODYxMDMuNTYuMC4w*_ga_5EPM2P39FV*MTcxNjM4NTE1Ni4xNTcuMS4xNzE2Mzg2MTAzLjAuMC4zMjM3MzE2MTE.&_ga=2.25230836.839088300.1716203378-1631866794.1711981188  DSR_TEST1 https://community.splunk.com/t5/Splunk-Search/How-to-Combine-search-query-with-a-lookup-file-with-one-common/td-p/296885?sort=votes  DSR_TEST2 https://docs.splunk.com/Documentation/Splunk/9.2.1/SearchReference/Gauge  ... View more

Hi @gcusello  1.Still i am not able to get Link values in the table . 2. Then the condition Status LIKE (,"%") is wrong, what do you want to check?. --->checking for Status  as * ... View more

Hi @gcusello  yes i have another field as interfacename is given below and in my lookup file i have same name as Interfacename . But i dont know to map values using append. values(content.payload.InterfaceName) as InterfaceName     ... View more

Hi @gcusello  In lookup file i have two fields one is interface name another one is link based on interface name we can map Right. ... View more

Hi @gcusello  Need to map based on interface name with link ... View more

Hi @gcusello  This the query which i am trying to map Interfacename and link .So i appended the inputlookup with base query .In base query also i have interface name.So i am trying to map the values.But the link is not populating in the table. index="mulesoft" environment=PRD | rename content.payload.Status as Status | append [ inputlookup link.csv | table Link InterfaceName] | stats values(content.payload.InterfaceName) as payLoadInterface values(content.payload.ErrorMessage) as ErrorMsg earliest(timestamp) as Timestamp values(priority) as Priority values(tracePoint) as Tracepoint values(Link) as Link values(InterfaceName) as Interface by correlationId | eval names = if ( isnull ( mvfind ( message, "DISABLED" ) ), null, message ) | eval Response= coalesce(SuccessResponse,Successresponse,msg,names,ErrorMsg) | eval InterfaceName= coalesce(Interface,payLoadInterface) | table Status Timestamp InterfaceName Link Response correlationId message Priority Tracepoint|fields - message Tracepoint Priority|search InterfaceName="*" | where Status LIKE ("%")|sort -Timestamp   ... View more

Hi @yuanliu  Thanks, how can we club the both into one to show count based on the two conditions ... View more

If error and exception then it should be error rest of them are success.but using the below query to get status still.i got both suuccess and error for the some of the transactions ID  | eval Status=case(priority="ERROR" AND tracePoint="EXCEPTION" OR message="*Error while processing*","ERROR", priority="WARN","WARN",priority!="ERROR" AND tracePoint!="EXCEPTION" OR message!="*(ERROR):*","SUCCESS") |stats values(Status) as Status by transactionId     ... View more

Based on priority field and tracepoint field i am getting the status field.If priority is error and tracepoint as exception then i set status as per the keyword.But in some case its showing both ERROR and SUCCESS. Message priority tracepoint After Common SFTP Get File List Response INFO AFTER_REQUEST  After Common SFTP Get File List Response INFO AFTER_REQUEST Before Common SFTP Get File Data Request INFO BEFORE_REQUEST Before Common SFTP Get File List Request INFO BEFORE_REQUEST Before Common SFTP Archive File Request INFO BEFORE_REQUEST File Upload Request for BEFORE_REQUEST INFO BEFORE_REQUEST File Upload to in SFTP mode. >>> END INFO END     END File Upload Request for f ERROR EXCEPTION Error while trying to upload file to GCP from Common SFTP ERROR EXCEPTION DEV(ERROR): Error while processing System request INFO BEFORE_REQUEST ... View more