Thanks @gcusello  ... View more

Hi @gcusello , I confused you it seems. Apologies for the same.  Your first understanding is correct. I need to extract the fields closed inside the bracket. Below is the sample one event and the same has been extracted using pairdelim and kvdelim. ============== 2023-04-25 23:15:00.438, BUSINESSIDENTIFIER="06-02-10112022-85346-L", MESSAGEIDENTIFIER="42920d7b-4bde-4a7c-9704-532bc178acfd", PAYLOAD="BusinessIdentifier : 06-02-10112022-85346-L ***** MessageIdentifier : 42920d7b-4bde-4a7c-9704-532bc178acfd ***** TimeStamp : 2023-04-25T23:00:48.149+08:00 ***** ElapsedTime : 0.05 ***** InterfaceName : BRM ***** ServiceLayerName : Remedy ***** ServiceLayerOperation : CreateQPBillingEvents ***** ServiceLayerPipeline : ServiceLayerErrorHandler ***** SiteID : AWS ***** DomainName : OSBDomain ***** ServerName : OSBServer ***** FusionErrorCode : ***** FusionErrorMessage : ***** <ns2:createQPBillEventsResponse xmlns:ns2="com.alcatel.lucent.on.ws.manager"><reason>Insert into tables failed-ORA-00001:Duplicate Check Fail for ORDER_ID[06-02-10112022-85346-L] TROUBLE_TICKET_ID[] CHARGETYPE [RSCN4]</reason><response_Code>-1</response_Code></ns2:createQPBillEventsResponse>", TIMESTAMP="2023-04-25 23:00:48.149", SERVICELAYEROPERATION="CreateQPBillingEvents", ELAPSEDTIME="0.05", SERVICELAYERPIPELINE="ServiceLayerErrorHandler", REASON="Insert into tables failed-ORA-00001:Duplicate Check Fail for ORDER_ID[06-02-10112022-85346-L] TROUBLE_TICKET_ID[] CHARGETYPE [RSCN4]", RESPONSECODE="-1"   =============== using the below Query  i have extracted all the fields except CHARGETYPE. CHARGETYPE is the value which needs to be extracted from the reason field  Sample value: CHARGETYPE [RSCN4]  index="general_prod" source="osblogprod" sourcetype="csv" | extract pairdelim="," kvdelim="=" | where like (REASON ,"%ORA-00001%") | eval DATE=strftime(_time, "%Y-%m-%d") | eval S.NO=1 | accum S.NO |dedup MESSAGEIDENTIFIER| table S.NO,DATE,BUSINESSIDENTIFIER,MESSAGEIDENTIFIER,SERVICELAYEROPERATION,CHARGETYPE,REASON|rename BUSINESSIDENTIFIER AS "Order ID", SERVICELAYEROPERATION AS "API NAME", REASON AS "OSB Observation" .Hope clarifies now.   ... View more

Hi @gcusello ,   Yes I need the mentioned field. But I need the column as well in the mentioned output. So can you modify my query itself as i am not good in rex and regex.  ... View more

Output: S.NO DATE Order ID MESSAGEIDENTIFIER API NAME CHARGETYPE OSB Observation 1 2023-04-25 06-02-10112022-85346-L 7ff79dca-a39b-4b00-8b76-bee72efbcb83 CreateQPBillingEvents Insert into tables failed-ORA-00001:Duplicate Check Fail for ORDER_ID[06-02-10112022-85346-L] TROUBLE_TICKET_ID[] CHARGETYPE [RSCN4] 2 2023-04-25 06-02-10112022-85346-L a08f16a0-2789-4216-a42d-623fae84c0b7 CreateQPBillingEvents Insert into tables failed-ORA-00001:Duplicate Check Fail for ORDER_ID[06-02-10112022-85346-L] TROUBLE_TICKET_ID[] CHARGETYPE [RSCN3] 3 2023-04-25 06-02-10112022-85346-L 9e0f0d13-488e-4e6a-934f-a5eb36c015ca CreateQPBillingEvents Insert into tables failed-ORA-00001:Duplicate Check Fail for ORDER_ID[06-02-10112022-85346-L] TROUBLE_TICKET_ID[] CHARGETYPE [RSCN3] 4 2023-04-25 06-02-10112022-85346-L 687e81b7-30b6-490e-90e6-552d09741a54 CreateQPBillingEvents Insert into tables failed-ORA-00001:Duplicate Check Fail for ORDER_ID[06-02-10112022-85346-L] TROUBLE_TICKET_ID[] CHARGETYPE [RSCN4] 5 2023-04-24 06-02-10112022-85346-L 85d38933-bc8f-4c56-944b-a1acd264140c CreateQPBillingEvents Insert into tables failed-ORA-00001:Duplicate Check Fail for ORDER_ID[06-02-10112022-85346-L] TROUBLE_TICKET_ID[] CHARGETYPE [RSCN3] ... View more

Hi @gcusello ,   Apologies I missed that part somehow. After setting the source path it is able to send the file successfully based on the modtime.    Thanks.   See you later for another issue.  ... View more

Hi @gcusello  It is a path. inside that path it is having the 48 files (SQL output but with 1 or 2 lines each file). I tried with /* but it thrown error like below.   Invalid key in stanza [monitor:///u01/app/oracle/Scripts/SplunkDashboard/Check/*] in /opt/splunkforwarder/etc/apps/search/local/inputs.conf, line 15: CHECK_METHOD (value: modtime).   Then i updated the check method in props.conf but no luck   [brm_deployment_dev] BREAK_ONLY_BEFORE_DATE = DATETIME_CONFIG = CURRENT INDEXED_EXTRACTIONS = csv KV_MODE = none LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = Structured description = Comma-separated value format. Set header and other settings in "Delimited Settings" disabled = false pulldown_type = true HEADER_FIELD_LINE_NUMBER=1 CHECK_METHOD = modtime ... View more

@gcusello  Thanks for the reply.  I don't know how the issue resolved. but somehow it is forwarding from that server. But again in one more server the file contents are not changed, hence splunk is ignoring the files under the folder. I need to forward it whenever the script output updated.    Below are the settings.   Props.conf   [brm_deployment_dev] BREAK_ONLY_BEFORE_DATE = DATETIME_CONFIG = CURRENT INDEXED_EXTRACTIONS = csv KV_MODE = none LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = Structured description = Comma-separated value format. Set header and other settings in "Delimited Settings" disabled = false pulldown_type = true HEADER_FIELD_LINE_NUMBER=1   inputs.conf   [monitor:///u01/app/oracle/Scripts/SplunkDashboard/Check] disabled = false index=general sourcetype=brm_deployment_dev crcSalt=<SOURCE> initCrcLength=2048 CHECK_METHOD = modtime ... View more

Actually again in one server for another output same kind of error seen. As you recommended I can't set the field names as I have 40 files under the same folder and also the common thing is all these are SQL outputs. Can someone help me with this error as this is blocking the full work . I tried too many settings nothing helped. @isoutamo @woodcock @gcusello ... View more

@bowesmana  Thanks. It worked actually, I tried as a single panel.  When i view the bar graph for 1 month, it is showing as 1 hour bar chart graph as in query i gave it as span=1h. Is there any possible way if i click more than a week it needs to show the count for the day. ... View more

@gcusello  Thanks for the prompt response. It worked.  But when i am executing the provided command getting the error in eval as malformed function. But if I execute like this it works fine. How can i validate the source file name as well so that it won't have wrong result if duplicates present. | eval status=if(sourcetype_count=2,"Both","Not present")   ... View more

Thanks for the reply. If i have the same field name in both the files by which command can i mark the new field as true if existing in second file else false. Can i use  ... View more