Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About gauravkumar85
gauravkumar85
Path Finder
Member since:
04-16-2024
11-28-2024
Community Statistics
| Posts | 14 |
| Solutions | 0 |
| Karma Given | 6 |
| Karma Received | 0 |
| Member Since | 04-16-2024 |
Activity Feed
- Posted Re: How can i use Global Time Picker in my search on Splunk Search. 11-28-2024 11:52 AM
- Karma Re: How can i use Global Time Picker in my search for marnall. 11-28-2024 11:51 AM
- Posted Re: How can i use Global Time Picker in my search on Splunk Search. 11-28-2024 11:08 AM
- Posted How can i use Global Time Picker in my search on Splunk Search. 11-28-2024 09:31 AM
- Posted Re: Want To extract fields and values from JSON on Splunk Search. 07-16-2024 03:52 AM
- Posted Re: Want To extract fields and values from JSON on Splunk Search. 07-15-2024 10:06 AM
- Posted Re: Want To extract fields and values from JSON on Splunk Search. 07-09-2024 05:21 AM
- Posted Re: Want To extract fields and values from JSON on Splunk Search. 07-09-2024 05:07 AM
- Karma Re: Want To extract fields and values from JSON for yuanliu. 07-09-2024 04:51 AM
- Posted Re: Want To extract fields and values from JSON on Splunk Search. 06-27-2024 12:28 PM
- Posted Want To extract fields and values from JSON on Splunk Search. 06-27-2024 10:58 AM
- Karma Re: Want to extract field from JSON from complex json for ITWhisperer. 05-23-2024 10:33 AM
- Karma Re: Want to extract field from JSON from complex json for ITWhisperer. 05-23-2024 10:33 AM
- Posted Re: Want to extract field from JSON from complex json on Splunk Search. 04-22-2024 01:57 AM
- Posted Re: Want to extract field from JSON from complex json on Splunk Search. 04-17-2024 02:38 PM
- Tagged Re: Want to extract field from JSON from complex json on Splunk Search. 04-17-2024 02:38 PM
- Posted How can I extract field's from given JSON array and display running total of numeric column on Splunk Search. 04-16-2024 12:13 PM
- Karma Re: Want to extract field from JSON from complex json for ITWhisperer. 04-16-2024 12:01 PM
- Karma Re: Want to extract field from JSON from complex json for ITWhisperer. 04-16-2024 12:01 PM
- Posted Re: Want to extract field from JSON from complex json on Splunk Search. 04-16-2024 07:19 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-28-2024
11:52 AM
finally its working . Thank you all for your help
| mvexpand message
| rename message as _raw
| fields - {}.* ``` optional ```
| spath path={}
| mvexpand {}
| fields - _* ``` optional ```
| spath input={}
| search TARGET_SYSTEM="EAS"
| eval lookupfiledatestart =strftime(INSERT_DATE,"%m/%d/%Y") | addinfo | eval _time = strftime(info_min_time,"%m/%d/%Y")
| where _time=INSERT_DATE
| chart sum(TRANSACTION_COUNT) as TRANSACTION_COUNT by INSERT_DATE
... View more
11-28-2024
11:08 AM
i modified my search but not getting any result index = ****** host=transaction source=prd | spath | mvexpand message | rename message as _raw | fields - {}.* ``` optional ``` | spath path={} | mvexpand {} | fields - _* ``` optional ``` | spath input={} | search TARGET_SYSTEM="EAS" | chart sum(TRANSACTION_COUNT) as TRANSACTION_COUNT by INSERT_DATE | addinfo | eval _time =info_min_time | where INSERT_DATE=_time My ROW Data: [{"ID":"115918","TARGET_SYSTEM":"EAS","REVIEW":"CPW_00011H","TOTAL_INVENTORY":0,"TOTAL_HITS":0,"TRANSACTION_TYPE":"MQ","TRANSACTION_NAME":"HO620I","TRANSACTION_COUNT":4,"PROCESS_DATE":"11/26/2024","INSERT_DATE":"11/27/2024"} ,{"ID":"115919","TARGET_SYSTEM":"EAS","REVIEW":"CPW_00011H","TOTAL_INVENTORY":0,"TOTAL_HITS":0,"TRANSACTION_TYPE":"MQ","TRANSACTION_NAME":"HO626I","TRANSACTION_COUNT":39,"PROCESS_DATE":"11/26/2024","INSERT_DATE":"11/27/2024"}] When i am not using where condition its giving me data. index = **** host=transaction source=prd | spath | mvexpand message | rename message as _raw | fields - {}.* ``` optional ``` | spath path={} | mvexpand {} | fields - _* ``` optional ``` | spath input={} | search TARGET_SYSTEM="EAS" | chart sum(TRANSACTION_COUNT) as TRANSACTION_COUNT by INSERT_DATE | addinfo | eval _time =info_min_time
... View more
11-28-2024
09:31 AM
I have dataset which have field INSERT_DATE now i want to perform search based the date which is match with Global Time Picker Search what i want to is index = ******* host=transaction source=prd | spath | mvexpand message | rename message as _raw | fields - {}.* ``` optional ``` | spath path={} | mvexpand {} | fields - _* ``` optional ``` | spath input={} | search TARGET_SYSTEM="EAS" | eval _time=strptime(INSERT_DATE, "%m/%d/%Y") | chart sum(TRANSACTION_COUNT) as TRANSACTION_COUNT by INSERT_DATE | where INSERT_DATE =strftime($global_time.latest$, "%m/%d/%Y")
... View more
07-16-2024
03:52 AM
This query is working fine with the given example But when I am running given query in index it not producing any result. index = cba_hcck8s_UHGWM110-013948 host=prod_poc source=poc | fields - {}.* ``` optional ``` | spath path={} | mvexpand {} | fields - _* ``` optional ``` | spath input={} | eval totalCount = SKIPPED + PROCESSED | chart sum(SKIPPED) as SKIPPED,sum(PROCESSED) as Processed sum(totalCount) as TotalClaims by DAYHOUR DATE I am getting no result with this query. You know my data reside in message under event field. Might be this query not reaching message field where rest of the data stored in array. Also adding my row text {"id":"0","severity":"Information","message":"[{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00343\",\"TOTAL\":0,\"PROCESSED\":11,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00253\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":15,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00598H\",\"TOTAL\":0,\"PROCESSED\":4,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_02141\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":9,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00447\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":5,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00253H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":7,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00031AdjPro\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":30,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00343\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":43,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00031\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":9,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_HOSPICE_CLM\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":1,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00283\",\"TOTAL\":0,\"PROCESSED\":16,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_02107\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":2,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00283\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":104,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_02141\",\"TOTAL\":0,\"PROCESSED\":8,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00674\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":17,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00253\",\"TOTAL\":0,\"PROCESSED\":40,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00758H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":6,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_02076H\",\"TOTAL\":0,\"PROCESSED\":27,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00283H\",\"TOTAL\":0,\"PROCESSED\":9,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00120H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":14,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00721H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":105,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00479\",\"TOTAL\":0,\"PROCESSED\":7,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_05009H\",\"TOTAL\":0,\"PROCESSED\":13,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00243\",\"TOTAL\":0,\"PROCESSED\":47,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_02061\",\"TOTAL\":0,\"PROCESSED\":1,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00119\",\"TOTAL\":0,\"PROCESSED\":9,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00035\",\"TOTAL\":0,\"PROCESSED\":101,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_02093\",\"TOTAL\":0,\"PROCESSED\":188,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00680\",\"TOTAL\":0,\"PROCESSED\":5,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00394\",\"TOTAL\":0,\"PROCESSED\":198,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_01902\",\"TOTAL\":0,\"PROCESSED\":4,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00363\",\"TOTAL\":0,\"PROCESSED\":12,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00072H\",\"TOTAL\":0,\"PROCESSED\":2,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00035\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":25,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00660\",\"TOTAL\":0,\"PROCESSED\":19,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_02093\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_02117\",\"TOTAL\":0,\"PROCESSED\":58,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00035Med\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":5,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_CSTATUS\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":16,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00363\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":24,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_01902\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":2,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_02149\",\"TOTAL\":0,\"PROCESSED\":3,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00072H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":28,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00380\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":8,\"FAILED\":8,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00367\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":2,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00200\",\"TOTAL\":0,\"PROCESSED\":28,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00479\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":23,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00663\",\"TOTAL\":0,\"PROCESSED\":3,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00119\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00243\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":25,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00598H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":482,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00031Medica\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":6,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00108\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":2,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00253H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":2,\"FAILED\":2,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_02131H\",\"TOTAL\":0,\"PROCESSED\":71,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_01000H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":18,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00367\",\"TOTAL\":0,\"PROCESSED\":1,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00674\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":1,\"FAILED\":1,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00680\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":7,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00313\",\"TOTAL\":0,\"PROCESSED\":1,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_01010\",\"TOTAL\":0,\"PROCESSED\":1,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00674\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":141,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00660\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":94,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00253H\",\"TOTAL\":0,\"PROCESSED\":12,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/16/2024\",\"DAYHOUR\":3}]"}
... View more
07-15-2024
10:06 AM
My actually event look like below. And I am searching on last 24 Hours events.
When I am using below query
index = cba_hcck8s_UHGWM110-013948 host=prod_poc source=poc| spath | eval message="{\"message\":".message."}" | spath input=message message{} output=collection | mvexpand collection | spath input=collection |eval totalCount = SKIPPED + PROCESSED|chart sum(totalCount) as TotalClaims by DAYHOUR DATE
its not giving me below given events if I am removing the spath then its start matching below events only and rest of the events not matching. not sure why its behaving like this.
index = cba_hcck8s_UHGWM110-013948 host=prod_poc source=poc| spath | eval message="{\"message\":".message."}" | spath input=message message{} output=collection | mvexpand collection | spath input=collection |eval totalCount = SKIPPED + PROCESSED|chart sum(totalCount) as TotalClaims by DAYHOUR DATE
Event-
[{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00031AdjPro","TOTAL":0,"PROCESSED":1,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00031AdjPro","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":2118,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00035","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":1,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00035Med","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":1,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00052Med","TOTAL":0,"PROCESSED":2898,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00052Med","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":3,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00075","TOTAL":0,"PROCESSED":94,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00075","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":2,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00075","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":59,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00119","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":3,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00201H","TOTAL":0,"PROCESSED":1,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00243","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":1,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00243","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":1,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00283H","TOTAL":0,"PROCESSED":7,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00283H","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":104,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00302","TOTAL":0,"PROCESSED":1395,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00302","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":5,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00304","TOTAL":0,"PROCESSED":299,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00304","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":16,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00310","TOTAL":0,"PROCESSED":2,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00365","TOTAL":0,"PROCESSED":588,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00365","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":619,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00479H","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":4,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00479H","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":1,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00607Bundle","TOTAL":0,"PROCESSED":1,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00646","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":1,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00646","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":2,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00681","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":1,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00721H","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":1,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_02071","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":2,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_02229","TOTAL":0,"PROCESSED":1,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_02278","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":1,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_HOSPICE_CLM","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":1,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":15}]
Event-
[{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00011H","TOTAL":0,"PROCESSED":1,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":16},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00011H","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":35,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":16},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00061","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":1,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":16},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_HOSPICE","TOTAL":0,"PROCESSED":27,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":16},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_HOSPICE","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":60,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":16},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_HOSPICE_CLM","TOTAL":0,"PROCESSED":1240,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":16},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_HOSPICE_CLM","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":14,"PROCESSING":0,"DATE":"7/14/2024","DAYHOUR":16}]
... View more
07-09-2024
05:21 AM
Below is my two ROW event- message: [{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00253","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":1,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00314","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":6,"FAILED":6,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00314","TOTAL":0,"PROCESSED":7295,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00052Med","TOTAL":0,"PROCESSED":273,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00011H","TOTAL":0,"PROCESSED":23,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00303","TOTAL":0,"PROCESSED":8,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00355","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":22,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_01015","TOTAL":0,"PROCESSED":3,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00011H","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":2,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00314","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":38,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00355","TOTAL":0,"PROCESSED":44,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00364","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":6,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00302","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":2,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00364","TOTAL":0,"PROCESSED":7177,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00302","TOTAL":0,"PROCESSED":116,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00607Bundle","TOTAL":0,"PROCESSED":37,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00086","TOTAL":0,"PROCESSED":215,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00061","TOTAL":0,"PROCESSED":4,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00607Bundle","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":14,"FAILED":14,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00030","TOTAL":0,"PROCESSED":21,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00075Med","TOTAL":0,"PROCESSED":546,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00030","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":801,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00022AdjPro","TOTAL":0,"PROCESSED":150,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00473H","TOTAL":0,"PROCESSED":69,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00075Med","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":542,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00607Bundle","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":2,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00022AdjPro","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":335,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00473H","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":10,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00304","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":12,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00304","TOTAL":0,"PROCESSED":637,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00396","TOTAL":0,"PROCESSED":2,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00079MEDICA","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":88,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00086","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":1,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00079MEDICA","TOTAL":0,"PROCESSED":24,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00304","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":1,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00022AdjPro","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":1,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":5}] message: [{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00253","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":1,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":4},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00797H","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":2,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":4},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00365","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":511,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":4},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00365","TOTAL":0,"PROCESSED":210,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":4},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00410","TOTAL":0,"PROCESSED":8,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":4},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00396","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":1,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":4},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00410","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":21,"PROCESSING":0,"DATE":"7/9/2024","DAYHOUR":4}]
... View more
07-09-2024
05:07 AM
I am using below query and its throwing [nxg-splunk-idx503,nxg-splunk-idx504,nxg-splunk-idx506] Field 'collection' does not exist in the data. Same query is working fine for other events. Its only failing for the hour 5 and 4 index = ***** host=**** source=***| spath | eval message="{\"message\":".message."}" | spath input=message message{} output=collection | mvexpand collection | spath input=collection |eval totalCount = SKIPPED + PROCESSED|chart sum(SKIPPED) as SKIPPED,sum(PROCESSED) as Processed sum(totalCount) as TotalClaims by DAYHOUR DATE Below is my two ROW event- Event 1 {"id":"0","severity":"Information","message":"[{\"TARGETSYSTEM\"😕"CPW\",\"ARUNAME\"😕"CPW_00253\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\"😕"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\"😕"CPW\",\"ARUNAME\"😕"CPW_00314\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":6,\"FAILED\":6,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\"😕"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\"😕"CPW\",\"ARUNAME\"😕"CPW_00314\",\"TOTAL\":0,\"PROCESSED\":7295,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\"😕"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\"😕"CPW\",\"ARUNAME\"😕"CPW_00303\",\"TOTAL\":0,\"PROCESSED\":8,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\"😕"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\"😕"CPW\",\"ARUNAME\"😕"CPW_00355\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":22,\"PROCESSING\":0,\"DATE\"😕"7/9/2024\",\"DAYHOUR\":5},{\"TARGETSYSTEM\"😕"CPW\",\"ARUNAME\"😕"CPW_01015\",\"TOTAL\":0,\"PROCESSED\":3,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\"😕"7/9/2024\",\"DAYHOUR\":5}{\"TARGETSYSTEM\"😕"CPW\",\"ARUNAME\"😕"CPW_00302\",\"TOTAL\":0,\"PROCESSED\":116,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\"😕"7/9/2024\",\"DAYHOUR\":5}]"} Event 2 {"id":"0","severity":"Information","message":"[{\"TARGETSYSTEM\"😕"CPW\",\"ARUNAME\"😕"CPW_00253\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\"😕"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\"😕"CPW\",\"ARUNAME\"😕"CPW_00797H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":2,\"PROCESSING\":0,\"DATE\"😕"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\"😕"CPW\",\"ARUNAME\"😕"CPW_00365\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":511,\"PROCESSING\":0,\"DATE\"😕"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\"😕"CPW\",\"ARUNAME\"😕"CPW_00365\",\"TOTAL\":0,\"PROCESSED\":210,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\"😕"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\"😕"CPW\",\"ARUNAME\"😕"CPW_00410\",\"TOTAL\":0,\"PROCESSED\":8,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\"😕"7/9/2024\",\"DAYHOUR\":4},{\"TARGETSYSTEM\"😕"CPW\",\"ARUNAME\"😕"CPW_00410\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":21,\"PROCESSING\":0,\"DATE\"😕"7/9/2024\",\"DAYHOUR\":4}]"} You know its scanned 8 events and its matched with only 5 . Now sure why those events which is generated in hour 4 and 5 are not matching
... View more
06-27-2024
12:28 PM
Here is the exact Message which have message: [{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_ARO_P","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":36,"PROCESSING":0,"DATE":"6/27/2024","DAYHOUR":23},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_ARO_P","TOTAL":0,"PROCESSED":8,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"6/27/2024","DAYHOUR":23},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_ARO_P","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":1,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"6/27/2024","DAYHOUR":23},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00410","TOTAL":0,"PROCESSED":4,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"6/27/2024","DAYHOUR":23},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_ARO_H","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":29,"PROCESSING":0,"DATE":"6/27/2024","DAYHOUR":23},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_00410","TOTAL":0,"PROCESSED":0,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":1,"PROCESSING":0,"DATE":"6/27/2024","DAYHOUR":23},{"TARGETSYSTEM":"CPW","ARUNAME":"CPW_ARO_H","TOTAL":0,"PROCESSED":139,"REMAINING":0,"ERROR":0,"FAILED":0,"SKIPPED":0,"PROCESSING":0,"DATE":"6/27/2024","DAYHOUR":23}]
... View more
06-27-2024
10:58 AM
Below is my row text in Splunk and i want to extract JSON array from from below row text. After extract I want to do group by ARUNAME and wanted to calculate the sum of SKIPPED and PROCESSED value {"id":"0","severity":"Information","message":"[{\"TARGETSYSTEM\":confused_face:"CPW\",\"ARUNAME\":confused_face:"CPW_ARO_P\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":36,\"PROCESSING\":0,\"DATE\":confused_face:"6/27/2024\",\"DAYHOUR\":23},{\"TARGETSYSTEM\":confused_face:"CPW\",\"ARUNAME\":confused_face:"CPW_ARO_P\",\"TOTAL\":0,\"PROCESSED\":8,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":confused_face:"6/27/2024\",\"DAYHOUR\":23},{\"TARGETSYSTEM\":confused_face:"CPW\",\"ARUNAME\":confused_face:"CPW_ARO_P\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":1,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":confused_face:"6/27/2024\",\"DAYHOUR\":23},{\"TARGETSYSTEM\":confused_face:"CPW\",\"ARUNAME\":confused_face:"CPW_00410\",\"TOTAL\":0,\"PROCESSED\":4,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":confused_face:"6/27/2024\",\"DAYHOUR\":23},{\"TARGETSYSTEM\":confused_face:"CPW\",\"ARUNAME\":confused_face:"CPW_ARO_H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":29,\"PROCESSING\":0,\"DATE\":confused_face:"6/27/2024\",\"DAYHOUR\":23},{\"TARGETSYSTEM\":confused_face:"CPW\",\"ARUNAME\":confused_face:"CPW_00410\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\":confused_face:"6/27/2024\",\"DAYHOUR\":23},{\"TARGETSYSTEM\":confused_face:"CPW\",\"ARUNAME\":confused_face:"CPW_ARO_H\",\"TOTAL\":0,\"PROCESSED\":139,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":confused_face:"6/27/2024\",\"DAYHOUR\":23}]"}
... View more
Labels
- Labels:
-
count
-
eval
-
field extraction
-
fields
-
regex
04-22-2024
01:57 AM
Thanks for you response. Your solution is working fine and create below query for search. index = **** host=***| spath | eval message="{\"message\":".message."}" | spath input=message message{} output=collection | mvexpand collection | spath input=collection | stats sum(TOTAL) as Total, sum(PROCESSED) as Processed sum(SKIPPED) as Skipped by TARGETSYSTEM I am using above query. Below chart is created using above query. Now I want to display inventory with date in chart. I want display like below
... View more
04-17-2024
02:38 PM
{"id":"0","severity":"Information","message":"[{\"TARGETSYSTEM\":\"SEQ\",\"ARUNAME\":\"CPW_02170\",\"TOTAL\":437330,\"PROCESSED\":436669,\"REMAINING\":661,\"ERROR\":0,\"SKIPPED\":112},{\"TARGETSYSTEM\":\"SEQ\",\"ARUNAME\":\"CPW_02171\",\"TOTAL\":78833,\"PROCESSED\":78832,\"REMAINING\":1,\"ERROR\":0,\"SKIPPED\":35},{\"TARGETSYSTEM\":\"SEQ\",\"ARUNAME\":\"CPW_02169H\",\"TOTAL\":100192,\"PROCESSED\":100192,\"REMAINING\":0,\"ERROR\":0,\"SKIPPED\":20016},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00061\",\"TOTAL\":7,\"PROCESSED\":0,\"REMAINING\":7,\"ERROR\":0,\"SKIPPED\":0},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_01015\",\"TOTAL\":9,\"PROCESSED\":0,\"REMAINING\":9,\"ERROR\":0,\"SKIPPED\":0},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00011H\",\"TOTAL\":17,\"PROCESSED\":0,\"REMAINING\":17,\"ERROR\":0,\"SKIPPED\":0},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00079\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"SKIPPED\":0},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_02191\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"SKIPPED\":0},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_02184\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"SKIPPED\":0},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_07009CS\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"SKIPPED\":0},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00304\",\"TOTAL\":1318,\"PROCESSED\":1318,\"REMAINING\":0,\"ERROR\":0,\"SKIPPED\":24},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00314\",\"TOTAL\":6188,\"PROCESSED\":6188,\"REMAINING\":0,\"ERROR\":0,\"SKIPPED\":1},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00355\",\"TOTAL\":505,\"PROCESSED\":462,\"REMAINING\":43,\"ERROR\":0,\"SKIPPED\":11},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00364\",\"TOTAL\":12934,\"PROCESSED\":2804,\"REMAINING\":10130,\"ERROR\":0,\"SKIPPED\":1},{\"\":\"EAS\",\"ARUNAME\":\"CPW_02130\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"SKIPPED\":0}]"} I want below two views from same data First View: Second view:
... View more
- Tags:
- s
04-16-2024
12:13 PM
{"id":"0","severity":"Information","message":[{"TARGET_SYSTEM":"SEQ","FUNCTION_NAME":"CPW_02170","TOTAL":"121257","PROCESSED":"121257","REMAINING":"0","ERROR":"0 (0%)","SKIPPED":"35 (0%)","ERROR_IND":"0","ERROR_1":"0"},{"TARGET_SYSTEM":"CPW","FUNCTION_NAME":"CPW_02171","TOTAL":"26434","PROCESSED":"26434","REMAINING":"0","ERROR":"0 (0%)","SKIPPED":"19 (0%)","ERROR_IND":"0","ERROR_1":"0"},{"TARGET_SYSTEM":"SEQ","FUNCTION_NAME":"CPW_02172","TOTAL":"23343","PROCESSED":"2647812","REMAINING":"0","ERROR":"0 (0%)","SKIPPED":"19 (0%)","ERROR_IND":"0","ERROR_1":"0"}]} I want to extract all fields in the form of table from "message" which is holding JSON array . And I want a total row for each column where total running total will display for each numeric column based on TARGET_SYSTEM .
... View more
Labels
- Labels:
-
field extraction
-
fields
-
regex
-
rex
-
table
04-16-2024
07:19 AM
Thank you so much for prompt reply. Below is the fixed format of the data. Please help me on this. {"id":"0","severity":"Information","message":"CPWTotal=749860, SEQTotal=1026137, EASTotal=1062804, VRSTotal=238, CPWRemaining=5612, SEQRemaining=32746, EASRemaining=15, VRSRemaining=0, InvetoryDate=4/16/2024 7:34:25 PM"} Need to extract fields in below format. Your help really appreciated. CPW Total SEQ Total EAS Total VRS Total CPW Remaining SEQ Remaining EAS Remaining VRS Remaining InvetoryDate 844961 244881 1248892 238 74572 22 62751 0 4/15/2024 6:16:07 AM
... View more
04-16-2024
02:41 AM
My row data will look like below _row= {"id":"0","severity":"Information","message":"CPW Total= 844961,SEQ Total =244881, EAS Total=1248892, VRS Total=238, CPW Remaining=74572, SEQ Remaining=22, EAS Remaining =62751, VRS Remaining =0, InvetoryDate =4/15/2024 6:16:07 AM"} I want to extract fields from message and it will look like below. I tried the through rgex but I am unable to extract. Please help to create extract for CPW Total SEQ Total EAS Total VRS Total CPW Remaining SEQ Remaining EAS Remaining VRS Remaining InvetoryDate 844961 244881 1248892 238 74572 22 62751 0 4/15/2024 6:16:07 AM
... View more
Labels
- Labels:
-
field extraction
-
fields
-
regex
-
rex
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-28-2024
04:13 PM
|
