Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About VictorCrunch
VictorCrunch
Loves-to-Learn
Member since:
07-28-2020
04-08-2021
Community Statistics
| Posts | 6 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 07-28-2020 |
Activity Feed
- Posted Why isn't transaction working for me? on Splunk Search. 03-04-2021 09:47 AM
- Posted Re: How to print non-unique values for each row in a table on Splunk Search. 08-03-2020 05:10 AM
- Posted Re: How to print non-unique values for each row in a table on Splunk Search. 07-29-2020 11:22 AM
- Posted Re: How to print non-unique values for each row in a table on Splunk Search. 07-29-2020 06:05 AM
- Posted Re: How to print non-unique values for each row in a table on Splunk Search. 07-28-2020 12:45 PM
- Posted How to print non-unique values for each row in a table? on Splunk Search. 07-28-2020 10:21 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
03-04-2021
09:47 AM
I have a process where I load data into database tables. My log file has the following entries for each : TableLoad=Begin TableName=Tablename TableLoad=End I have confirmed that I have the above 3 entries in the above order for each table. I also have a transaction defined as follows: transaction startswith="TableLoad=Begin" endswith="TableLoad=End" My Splunk report creates a separate line for each table, along with a status of the load for each. This works works well up to the point where my log file reports an error. The error is reported correctly, but the remaining lines are missing fields. For example, the next line of the report displays the next table name in the sequence, and nothing else. Each of the remaining lines are missing fields. Any idea of what I'm doing wrong?
... View more
Labels
- Labels:
-
fields
-
transaction
08-03-2020
05:10 AM
@to4kawaThanks for the response, but unfortunately that didn't make a difference in the output. Is it possible to "force" a new transaction in a log file? I have a similar Splunk report that works well, the only difference being that the log for each table is contained in a separate log file.
... View more
07-29-2020
11:22 AM
@richgalloway I changed the order of the statements, but that didn't have any effect on my output. Thanks for your input though.
... View more
07-29-2020
06:05 AM
@richgallowayHere's the code I'm running:. index=miscapps sourcetype="app:z-ingest" transaction source | where ProcessType = "UseCaseIngestion" AND isnotnull(TableName) | eval CurrDate = now() | eval RunDate = strptime(TimeStamp, "%m/%d/%y") | eval DaysSinceLoad = round((CurrDate - RunDate)/86400) | fillnull value=0 DaysSinceLoad, ExtractRowCount, LandingRowCount, ProdRowCount, ReturnCode | convert dur2sec(Duration) as Duration2 | eval Hour = floor(Duration2/3600) | eval Duration2 = strftime(Duration2, "%M:%S") | eval result = (Hour.":".Duration2) | eval Status=if((ReturnCode = 0) AND (DaysSinceLoad < 8), "Successful", "Error") | eval ErrMsg= case(ReturnCode !=0, ErrorMessage, DaysSinceLoad > 7, "Stale Data Ingestion", 1=1, "None") | rename Duration2 as Duration | dedup UseCase, DatabaseName, TableName | filldown UseCase, DatabaseName, ReturnCode, DaysSinceLoad | table UseCase, DatabaseName, TableName, Status, ReturnCode, SourceRowCount, ExtrRowCount, DaysSinceLoad, Duration The ouput leaves the UseCase, DatabaseName. Status, ReturnCode, and DaysSinceLoad fields blank on the second row. I have everything for this job in a single log file, and I repeat every field in the log file each time I extract a new table.
... View more
07-28-2020
12:45 PM
@richgallowaythank you for the responcse, but filldown didn't solve my problem
... View more
07-28-2020
10:21 AM
I have a script that extracts table data from a database and loads the data to other tables in another database. Everything is written to a single log file, with all values reported for each table in the log file (e.g. table name, return code, row count, etc). I'm trying to write the results for each table into a Splunk table, but I'm finding that fields with a single value (e.g. ReturnCode) only print on the first row.
How can I modify this to print the value for every table?
... View more
Labels
- Labels:
-
table
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-08-2021
11:58 PM
|
