Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About scaparelli
scaparelli
Explorer
Member since:
07-22-2022
08-17-2022
Community Statistics
| Posts | 11 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 2 |
| Member Since | 07-22-2022 |
Activity Feed
- Posted Re: Why does this generic search not return results that are returned in a more specific search? on Splunk Search. 08-17-2022 09:15 AM
- Posted Re: Generic search does not return results that are returned in a more specific on Splunk Search. 08-16-2022 01:37 PM
- Posted Why does this generic search not return results that are returned in a more specific search? on Splunk Search. 08-16-2022 10:02 AM
- Got Karma for Why are similar rows not grouping together?. 08-13-2022 10:18 AM
- Posted Why are similar rows not grouping together? on Splunk Search. 08-10-2022 03:00 PM
- Posted Re: Using NOT in subsearch to find orders in search but not the other on Splunk Search. 07-27-2022 09:16 AM
- Posted Re: Using NOT in subsearch to find orders in search but not the other on Splunk Search. 07-26-2022 12:53 PM
- Posted Re: Using NOT in subsearch to find orders in search but not the other on Splunk Search. 07-26-2022 12:49 PM
- Got Karma for How to use NOT in subsearch to find orders in search but not the other?. 07-22-2022 02:40 PM
- Posted How to use NOT in subsearch to find orders in search but not the other? on Splunk Search. 07-22-2022 10:42 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 1 |
08-17-2022
09:15 AM
{"instant":{"epochSecond":1660665846,"nanoOfSecond":651267000},"thread":"inbound-listener-2","level":"INFO","loggerName":"com.nordstrom.fraud.fsp.listener.kafka.producer.KafkaProducer","message":"Sending a message to kafka topic=order-events-avro, messageKey=381263531, headers={AppId=APP02253, EventTime=1660665846651, Geolocation=47.613040, -122.334092, HEADER_GROUPING_ITEM_COUNT_KEY=1, HEADER_GROUPING_ITEM_INDEX=1, Id=OsOrsa3tjPJpBFwVQp6k56, Nord-Country-Code=US, Nord-Request-Id=16c555d0-a4d6-4059-9aec-9c015d9ce935, OmsModernStack=true, SchemaId=, SystemTime=1660665846651, Type=OrderLineChangeFraudApproved}, payload={\"orderNumber\": \"381263531\", \"orderLineId\": \"6c262fdae7bded09652eb32cf56546cb42d7e6cbc4f35625985a05b8ed2cda88\", \"serviceTicketId\": \"16c555d0-a4d6-4059-9aec-9c015d9ce935\", \"approvalDetails\": \"FRAUD_APPROVED\", \"eventTime\": 2022-08-16T16:04:06.651Z, \"source\": {\"channelCountry\": \"US\", \"channel\": \"OMNI\", \"platform\": \"CSR_PHONE\", \"feature\": \"OrderLineDestinationChangeRequested\", \"serviceName\": null, \"store\": null, \"register\": null}}","endOfBatch":false,"loggerFqcn":"org.apache.logging.slf4j.Log4jLogger","contextMap":{"aggregationGroupId":"16c555d0-a4d6-4059-9aec-9c015d9ce935","countryCode":"US","orderId":"381263531","requestId":"16c555d0-a4d6-4059-9aec-9c015d9ce935"},"threadId":334,"threadPriority":5} NordClientId="APP03176"|LogCategory="Information"|LogType="KafkaMessageProcessedSuccess"|message="OrderLineDestinationChangeRequested"|ServiceTicketId="16c555d0-a4d6-4059-9aec-9c015d9ce935"|OrderNumber="381263531"|OrderLineId="6c262fdae7bded09652eb32cf56546cb42d7e6cbc4f35625985a05b8ed2cda88"|EventTime="08/16/2022 16:03:14"|KafkaGroupId="Care-CustomerOrderModificationRequestConsumerDynamo-prod"|NordRequestId="16c555d0-a4d6-4059-9aec-9c015d9ce935"|ServerTimestamp="2022-08-16T16:03:15.8035047Z"|NordCountryCode="US"|Environment="PROD"|AppName="customerordermodificationrequestconsumerdynamo-prod"|Pod="release-branch-customerordermodificationrequestconsumerdynamo-prod"|KafkaEventId="16c555d0-a4d6-4059-9aec-9c015d9ce935_1"|KafkaEventType="OrderLineDestinationChangeRequested"|KafkaEventSystemTime="1660665795625"
... View more
08-16-2022
01:37 PM
So if you look closely at the queries, I am taking the orderId from the first query that has the `where` statement, and using it the exact same query without the `where` parameters but in the base search. The second query comes up with 2 events for the orderId whereas the first comes up with 1 event for the orderId. My question is why? The logs for that orderId should not exist in the first query result
... View more
08-16-2022
10:02 AM
I am developing a query that shows stats for events with the same orderId. There is a flaw though. When I run the query, I get results with only one event for an orderId, but when I take the orderId associated to only one event and put it in the original query, the result comes up with 2 events. Here are my queries and results:
(index=k8s_main LogType="KafkaMessageProcessedSuccess" message="OrderLineDestinationChangeRequested" Environment="PROD") OR (index=k8s_main container_name=fraud-single-proxy-listener message="Sending a message to kafka topic=order-events-avro*OrderLineDestinationChangeRequested*") | rename contextMap.orderId AS nefiOrderId OrderNumber AS omsOrderId | rename contextMap.requestId AS nefiRequestId NordRequestId AS omsRequestId | rename OrderLineId as omsOrderLineId | rex field=message "\"orderLineId\": \"(?<nefiOrderLineId>.*?)\", " | eval orderLineId = coalesce(nefiOrderLineId, omsOrderLineId) | eval requestId = mvappend(nefiRequestId, omsRequestId) | eval orderId = coalesce(nefiOrderId, omsOrderId) | stats dc(_time) AS eventCount values(_time) AS eventTime values(orderLineId) AS orderLineId values(requestId) AS requestId BY orderId | where eventCount = 1
Second query with the orderId in the initial search:
(index=k8s_main LogType="KafkaMessageProcessedSuccess" message="OrderLineDestinationChangeRequested" Environment="PROD" 381263531) OR (index=k8s_main container_name=fraud-single-proxy-listener message="Sending a message to kafka topic=order-events-avro*OrderLineDestinationChangeRequested*" 381263531) | rename contextMap.orderId AS nefiOrderId OrderNumber AS omsOrderId | rename contextMap.requestId AS nefiRequestId NordRequestId AS omsRequestId | rename OrderLineId as omsOrderLineId | rex field=message "\"orderLineId\": \"(?<nefiOrderLineId>.*?)\", " | eval orderLineId = coalesce(nefiOrderLineId, omsOrderLineId) | eval requestId = mvappend(nefiRequestId, omsRequestId) | eval orderId = coalesce(nefiOrderId, omsOrderId) | stats dc(_time) AS eventCount values(_time) AS eventTime values(orderLineId) AS orderLineId values(requestId) AS requestId BY orderId
... View more
Labels
- Labels:
-
field extraction
-
Other
08-10-2022
03:00 PM
1 Karma
For some reason there are entries that are not grouped together, but obviously look like they should be. In the following table, 2 rows with serviceTicketId = 00dcfe68-25d8-4c58-9228-5fc8f7ddb9d1 are on separate rows, other serviceTicketIds such as 00c093f4fc527e5ff7006566b1a0fd90 have one row, but multiple event times.
Here is my query:
(index=k8s_main "*Published successfully event=[com.nordstrom.customer.event.OrderLineReturnReceived*") OR (index="k8s_main" cluster="nsk-oak-prod" "namespace"=app04096 "*doPost - RequestId*") OR (index=k8s_main container_name=fraud-single-proxy-listener message="Successfully sent payload to kafka topic=order-events-avro*" contextMap.eventType="OrderLineReturnReceived") | rename contextMap.orderId AS nefiOrderId contextMap.serviceTicketId AS nefiServiceTicketId | rex field=eventKey "\[(?<omsOrderId>.*)\]" | rex field=serviceTicketId "\[(?<omsServiceTicketId>.*)\]" | rex "RequestId:(?<omniServiceTicketId>.*? )" | rex "\"orderNumber\":\"(?<omniOrderId>.*?)\"" | eval appId = mvappend(container_name, app) | eval orderId = mvappend(nefiOrderId, omsOrderId, omniOrderId) | eval serviceTicketId = mvappend(nefiServiceTicketId, omsServiceTicketId, omniServiceTicketId) | stats dc(_time) AS eventCount values(_time) AS eventTime values(appId) AS app BY serviceTicketId orderId | eval timeElapsed = now() - eventTime
... View more
Labels
- Labels:
-
stats
07-27-2022
09:16 AM
I actually just used rex to pull from the other fields. Here is my final solution: (index=k8s_main container_name=fraud-single-proxy-listener message="Successfully handled AuthorizationSucceeded event*") OR (index=app_pci source=http:nepp host=nepp-service-v3-prod message.message="Attempt to produce Kafka event finished: AuthorizationSucceeded*") | rex field=_raw "\"orderId\":\"(?<nefi>.*?)\"" | rex field=message.message "\"orderNumber\":\"(?<nepp>.*?)\"," | eval orderId = if(index="app_pci", nepp, nefi) | stats dc(index) AS indexCount values(_time) AS eventTime values(index) AS index BY orderId | eval timeElapsed = now() - eventTime | where indexCount = 1 AND index = "app_pci" AND (timeElapsed > (30*6000)) | fields orderId Thanks for your help!
... View more
07-26-2022
12:53 PM
Having trouble setting the eval "contextMap.orderId". If I run: (index=k8s_main container_name=fraud-single-proxy-listener message="Successfully handled AuthorizationSucceeded event*") OR (index=app_pci source=http:nepp host=nepp-service-v3-prod message.message="Attempt to produce Kafka event finished: AuthorizationSucceeded*") | eval contextMap.orderId=if(index="app_pci",properties.orderId,contextMap.orderId) | table contextMap.orderId I get rows but the contextMap.orderId = null
... View more
07-26-2022
12:49 PM
I am assuming you meant: | eval orderId=coalesce(properties.orderId, contextMap.orderId) and not | eval orderId=coalesce("properties.orderId", "contextMap.orderId") but even with the former, the "eval" does not want to be declared for some reason. even if I set orderId directly to "properties.orderId" it remains null: | eval orderId=properties.orderId I am positive that properties.orderId and context.orderId fields are present because I can get results by running: (index=k8s_main container_name=fraud-single-proxy-listener message="Successfully handled AuthorizationSucceeded event*") OR (index=app_pci source=http:nepp host=nepp-service-v3-prod message.message="Attempt to produce Kafka event finished: AuthorizationSucceeded*") | table properties.orderId, contextMap.orderId
... View more
07-22-2022
10:42 AM
1 Karma
First, let me explain my intention: I am attempting to create a query that would notify our team of a “stuck order”. An order is “stuck” when one team has produced an event and another team has not responded to said event. In this specific case, one team is producing an AuthorizationSucceeded event and another team is expected to produce a FraudDeclined/Approved event. I have tried using map, but I need to find the orderId's that do not exist in the second search, so I have moved on to subsearches using NOT. Here is my current query, but it is not producing the results I want. Ideally I want a list of orderIds that exist in: index=app_pci source=http:nepp host=nepp-service-v3-prod message.message="Attempt to produce Kafka event finished: AuthorizationSucceeded*"
but not in index=app_pci source=http:nepp host=nepp-service-v3-prod message.message="Attempt to produce Kafka event finished: AuthorizationSucceeded*"" Here is my query thus far: index=k8s_main container_name=fraud-single-proxy-listener message="Successfully handled AuthorizationSucceeded event*" NOT [search index=app_pci source=http:nepp host=nepp-service-v3-prod message.message="Attempt to produce Kafka event finished: AuthorizationSucceeded*" | rename properties.orderId as contextMap.orderId | table contextMap.orderId] Any Help would be amazing
... View more
Labels
- Labels:
-
subsearch
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-17-2022
07:27 PM
|
