Hello, I have an issue with the json data that is being ingested into Splunk using Universal Forwarder. Some times the json entries are ingested as individual entries in Splunk and other times the entire content is loaded as one single event. I tried to search for some special characters that might be causing this issue, but I wasn't able to find any.  Attached is a print screen with 2 examples, one that is being loaded as expected and the another where json is not correctly parsed. Did someone already faced something similar? What should I do to fix it? ... View more

Hi, Below is an example of my use case: timestamp messageId correlationId region category trace 17/05/2023 00:00 1 correlationA UCAN orders START 17/05/2023 00:01 2 correlationA UCAN orders FLOW 17/05/2023 00:02 3 correlationA UCAN orders FLOW 17/05/2023 00:03 4 correlationA UCAN orders FLOW 17/05/2023 00:04 5 correlationA UCAN orders FLOW 17/05/2023 00:05 6 correlationA UCAN orders FLOW 17/05/2023 00:06 7 correlationA UCAN orders FLOW 17/05/2023 00:07 8 correlationA UCAN orders END 17/05/2023 00:10 9 correlationB EMEA accounts START 17/05/2023 00:11 10 correlationB EMEA accounts FLOW 17/05/2023 00:12 11 correlationB EMEA accounts FLOW 17/05/2023 00:13 12 correlationB EMEA accounts FLOW 17/05/2023 00:14 13 correlationB EMEA accounts FLOW 17/05/2023 00:15 14 correlationB EMEA accounts FLOW 17/05/2023 00:16 15 correlationB EMEA accounts EXCEPTION   And the expected output: timestamp correlationId region category status #records duration 17/05/2023 00:10 correlationA UCAN order SUCCESS 6 00:07:00 17/05/2023 00:16 correlationB EMEA accounts ERROR 5 00:06:00   - the goal is to have one row per correlationId  - the column STATUS should be calculated with the following rule: if there is a row with trace=END it means that the flow ran successfully and the status should be "SUCCESS" and if there is a row with trace=EXCEPTION it means that an error occurred and the status should be "ERROR" - the number of records should consider only the rows with trace=FLOW - the duration should be the time elapsed from the row with trace=START until the row trace=END or trace=EXCEPTION Can you help on building the query? ... View more

Hello, I have a scenario where I need to create a custom column (status) that should be defined based on a criteria. CorrelationID tracePoint 123 START 123 BEFORE REQUEST 123 AFTER REQUEST 123 END 456 START 456 BEFORE REQUEST 456 EXCEPTION 789 START 789 AFTER REQUEST   Expected Output: CorrelationID tracePoint Status 123 START SUCCESS 123 BEFORE REQUEST SUCCESS 123 AFTER REQUEST SUCCESS 123 END SUCCESS 456 START ERROR 456 BEFORE REQUEST ERROR 456 EXCEPTION ERROR 789 START UNKNOWN 789 AFTER REQUEST UNKNOWN   Rule: for a given correlationID the status should be set to ERROR if for that correlationId there is a tracePoint=EXCEPRION, should be set to SUCCESS if for that correlationId there is a tracePoint=END and should be set to UNKNOWN if for that correlationID there is no tracePoint=EXCEPTION or tracePoint=END. Can you give me some guidance on how to achieve this scenario? Thanks!   ... View more