Hi Team. Could you please look into my post and respond on Automatic event correlation in Splunk ITSI (without creating manual correlation searches) for third party tools/ log4j? Thank you. ... View more

Hi @dtburrows3 , Thank you for your prompt response and it worked. Really appreciate your assistance. ... View more

Hi @danspav , Thank you for your response. I made the changes and when I clicked on the hyperlink, it is not redirecting to the correct dynamically generated external URL 'https://abc12345.apps.dynatrace.com/ui/apps/dynatrace.classic.distributed.traces/ui/services/SERVICE-ABC12345678AB1A1/purepaths?servicefilter=0%1E9%11SERVICE_METHOD-12345ABC1234A123%14abc%100%111340861000%144611686018427387&gtf=c_1716990969058_1716991269058&gf=all'. Here are the screenshots and code below. Please assist on this.     "visualizations": {         "viz_aBCd123": {             "type": "splunk.table",             "options": {                 "count": 5000,                 "dataOverlayMode": "none",                 "drilldown": "none",                 "backgroundColor": "#FAF9F6",                 "tableFormat": {                     "rowBackgroundColors": "> table | seriesByIndex(0) | pick(tableAltRowBackgroundColorsByBackgroundColor)",                     "headerBackgroundColor": "> backgroundColor | setColorChannel(tableHeaderBackgroundColorConfig)",                     "headerColor": "> headerBackgroundColor | maxContrast(tableRowColorMaxContrast)"                 },                 "eventHandlers": [                     {                         "type": "drilldown.customUrl",                         "options": {                             "url": "$row.URL.value|n$",                             "newTab": true                         }                     }                 ], ... View more

Hi @yuanliu , Here are my responses below. Please let me know if I missed anything. 1) What is your actual data structure? - It is in JSON format. userActions: [ [-] { [-] apdexCategory: FRUSTRATED application: xxx cdnBusyTime: null cdnResources: 0 cumulativeLayoutShift: 0.0006 customErrorCount: 0 dateProperties: [ [+] ] documentInteractiveTime: 13175 domCompleteTime: 15421 domContentLoadedTime: 14261 domain: xxx doubleProperties: [ [+] ] duration: 15430 endTime: 1714043044710 firstInputDelay: 1 firstPartyBusyTime: null firstPartyResources: 0 frontendTime: 14578 internalApplicationId: APPLICATION-B9BADE8D75A35E32 internalKeyUserActionId: APPLICATION_METHOD-E3EF5284923A6BA3 javascriptErrorCount: 0 keyUserAction: true largestContentfulPaint: 15423 loadEventEnd: 15430 loadEventStart: 15430 longProperties: [ [+] ] matchingConversionGoals: [ [+] ] name: loading of page /home navigationStart: 1714043029280 networkTime: 804 requestErrorCount: 0 requestStart: 630 responseEnd: 852 responseStart: 678 serverTime: 48 speedIndex: 13866 startTime: 1714043029280 stringProperties: [ [+] ] targetUrl: xxx thirdPartyBusyTime: null thirdPartyResources: 0 totalBlockingTime: null type: Load userActionPropertyCount: 0 visuallyCompleteTime: 15416 } ] 2) Is it close to what I speculated? Further, you have never illustrated what is expected output. So, the two screenshots with only timestamps means nothing to volunteers. How can we help further? -Yes correct, it is relevant to the data what you predicted and here is the expected output _time                                      Application      Action                   Target_URL          Duration       User_Action_Type 2024-04-25 07:39:53     xxx                      loading /home    www.abc.com    0.26                Load 2024-04-25 06:25:50     abc                     loading /wcc/ui/ www.xyz.com   3.00                 Load 2024-04-24 19:00:57     xyz                     keypress  policy   www.bdc.com  3.00                 Load 2024-04-24 17:05:11     abc                    loading /home      www.xyz.com   0.53                 Xhr 2024-04-24 10:14:47     bcd                    loading /prod        www.rst.com     0.02                 Load 3) Specifically, WHY should the output NOT have multiple timestamps after deduping application, name and target url? - I could see multiple timesteps after dedup the application, name and target url. Here is the screenshot below and see the yellow highlighted.   4) In your original SPL, the only dedup is on x, which is Application+Action+Target_URL. How is this different?. My bad, here is the below correct SPL query that I tried. index="dynatrace" sourcetype="dynatrace:usersession" source=saas_prod events{}.application="participantmanagement.thehartford.com" userExperienceScore=FRUSTRATED | rename userActions{}.application as Application, userActions{}.name as Action, userActions{}.targetUrl as Target_URL, userActions{}.duration as Duration, userActions{}.type as User_Action_Type, userActions{}.apdexCategory as useractions_experience_score | eval x=mvzip(mvzip(Application,Action),Target_URL), y=mvzip(mvzip(Duration,User_Action_Type),useractions_experience_score) | mvexpand x | mvexpand y | eval x=split(x,","), y=split(y,",") | eval Application=mvindex(x,0), Action=mvindex(x,1), Target_URL=mvindex(x,2), Duration=mvindex(y,0), User_Action_Type=mvindex(y,1), useractions_experience_score=mvindex(y,2) | eval Duration_in_Mins=Duration/60000 | eval Duration_in_Mins=round(Duration_in_Mins,2) | table _time, Application, Action, Target_URL,Duration_in_Mins,User_Action_Type,useractions_experience_score | search useractions_experience_score=FRUSTRATED | sort - _time | dedup _time | search Application="*" | search Action="*" | fields - useractions_experience_score 5) Anything after mvexpand in my search is based on my reading of your intent based only on that complex SPL sample. Instead of making volunteers to read your mind, how about expressing the actual dataset, the result you are trying to get from the data, and the logic to derive the desired result and dataset in plain language (without SPL)? Here is the actual dataset below. 4/25/24 7:39:53.000 AM { [-] applicationType: WEB_APPLICATION bounce: true browserFamily: Microsoft Edge browserMajorVersion: Microsoft Edge 122 browserType: Desktop Browser clientType: Desktop Browser connectionType: UNKNOWN dateProperties: [ [+] ] displayResolution: HD doubleProperties: [ [+] ] duration: 15430 endReason: TIMEOUT endTime: 1714043044710 errors: [ [+] ] events: [ [-] { [-] application: xxx internalApplicationId: APPLICATION-B9BADE8D75A35E32 name: Page change page: /index.html pageGroup: /index.html startTime: 1714043029280 type: PageChange } { [-] application: xxx internalApplicationId: APPLICATION-B9BADE8D75A35E32 name: Page change page: /home pageGroup: /home pageReferrer: /index.html pageReferrerGroup: /index.html startTime: 1714043043405 type: PageChange } { [-] application: xxx internalApplicationId: APPLICATION-B9BADE8D75A35E32 name: Page change page: /employee/details pageGroup: /employee/details pageReferrer: /employee/coverage-list pageReferrerGroup: /employee/coverage-list startTime: 1714043088821 type: PageChange } { [-] application: xxx internalApplicationId: APPLICATION-B9BADE8D75A35E32 name: Page change page: /employee/coverage-list pageGroup: /employee/coverage-list pageReferrer: /employee/details pageReferrerGroup: /employee/details startTime: 1714043403199 type: PageChange } ] hasCrash: false hasError: false hasSessionReplay: false internalUserId: 17140430425327CQRENIQATV2OT5DV5BTJ2UB3MQF2ALH ip: 10.215.67.0 longProperties: [ [+] ] matchingConversionGoals: [ [+] ] matchingConversionGoalsCount: 0 newUser: true numberOfRageClicks: 0 numberOfRageTaps: 0 osFamily: Windows osVersion: Windows 10 partNumber: 0 screenHeight: 720 screenOrientation: LANDSCAPE screenWidth: 1280 startTime: 1714043029280 stringProperties: [ [+] ] syntheticEvents: [ [+] ] tenantId: vhz76055 totalErrorCount: 0 totalLicenseCreditCount: 0 userActionCount: 1 userActions: [ [-] { [-] apdexCategory: FRUSTRATED application: xxx cdnBusyTime: null cdnResources: 0 cumulativeLayoutShift: 0.0006 customErrorCount: 0 dateProperties: [ [+] ] documentInteractiveTime: 13175 domCompleteTime: 15421 domContentLoadedTime: 14261 domain: xxx doubleProperties: [ [+] ] duration: 15430 endTime: 1714043044710 firstInputDelay: 1 firstPartyBusyTime: null firstPartyResources: 0 frontendTime: 14578 internalApplicationId: APPLICATION-B9BADE8D75A35E32 internalKeyUserActionId: APPLICATION_METHOD-E3EF5284923A6BA3 javascriptErrorCount: 0 keyUserAction: true largestContentfulPaint: 15423 loadEventEnd: 15430 loadEventStart: 15430 longProperties: [ [+] ] matchingConversionGoals: [ [+] ] name: loading of page /home navigationStart: 1714043029280 networkTime: 804 requestErrorCount: 0 requestStart: 630 responseEnd: 852 responseStart: 678 serverTime: 48 speedIndex: 13866 startTime: 1714043029280 stringProperties: [ [+] ] targetUrl: xxx thirdPartyBusyTime: null thirdPartyResources: 0 totalBlockingTime: null type: Load userActionPropertyCount: 0 visuallyCompleteTime: 15416 } ] userExperienceScore: FRUSTRATED userSessionId: UEFUBRDAPRDHURTCPUKFKKPJVORTPPJA-0 userType: REAL_USER   ... View more

Can someone assist on this request please? Thank you. ... View more