Need to monitor highlighted log file without extension in the mentioned folder. Adminportal_* and 584 will vary accordingly for other build in Jenkins.   I have defined path in different formats in inputs.conf file of Deployment Server. But its not getting indexed. Here is the content from the inputs.conf from the respective deployment app. # scan Jenkins Build logs [monitor://D:\Jenkins_Home\...\*]   --- ?? what is the exact path needs to be defined here ?? disabled = false recursive = true #time_before_close = 5 #ignoreOlderThan = 24h index = jenkins_logs sourcetype=jenkins:javalog Thank you !!!   ... View more

Hello Splunkers, Workflows are monitored through splunk. Workflows has different stages like running , paused, cancelled and completed. I have to get the latest status of the workflow. I am using sort - _time option to get the latest data of the status. Along with the search query by using the sort - _time option, data count varies. For last 7 days index=... | table _time EXECUTION_NAME STATUS EXECUTION_ID Stage Environment source | dedup EXECUTION_ID | chart count(EXECUTION_ID) as Workflows_Triggered by Environment,STATUS Environment COMPLETED PAUSED RUNNING XXX 94498 1 56 sort -_time option is used for last 7 days. index=... | table _time EXECUTION_NAME STATUS EXECUTION_ID Stage Environment source | sort -_time | dedup EXECUTION_ID | chart count(EXECUTION_ID) as Workflows_Triggered by Environment,STATUS Environment COMPLETED RUNNING XXX 9735 5 reason for using sort -_time is get the latest status of the execution_id. completed will be appeared when the dedup is done. _time STATUS EXECUTION_ID 2022-11-30 12:20:00.492 RUNNING 12345678901 2022-11-30 12:20:18.000 COMPLETED 12345678911 Requesting for support. Thank you !!! ... View more

Hello Friends, Basesearch | Table workflowname runid count status. When it's serached,results will be as mentioned below  workflowname runid count status Workflowname1 123    5      Completed Workflowname2 456    7      Paused Workflowname1 789    8      Completed Workflowname3 1011  4      Running Workflowname1 1013  4      Running Workflowname2 432    8      Completed I have configured an alert,to trigger when the result are greater than 0. Which means all the above mentioned results will be part of the email alert notification. When I use the suppress option by mentioning the fieldname as workflowname only one result been recieved as a part of email alert notifications.    Example how now the email is received  Email received for the Workflowname1 workflowname runid count status Workflowname1 123    5      Completed   Email received for the Workflowname2 workflowname runid count status Workflowname2 456    7      Paused   Can someone help out here with different email alert all the results for the unique workflowname should be triggered. Excepted one -  One mail for the workflowname1 workflowname runid count status Workflowname1 123    5      Completed Workflowname1 789    8      Completed Workflowname1 1013  4      Running   Other email for the workflowname2 workflowname runid count status Workflowname2 456    7      Paused Workflowname2 432    8      Completed   Separate email for the workflowname3 workflowname runid count status Workflowname3 1011  4      Running   Looking forward to hear inorder to achieve the above result    Thanks for the support. ... View more