About RamMur

RamMur · ‎03-14-2025

sorry, not really, the search on the right of the ioin, is a error log with documentId field but nothing else, the query on the right side of the join, is a search that will result in additioanl fiedls along with documentId, my attempt is to grab those additional fields , only when the documentId's match. i think query, gives everything, and doesnt give me results that has matching documentId's.

RamMur · ‎03-12-2025

Thanks for the Reply, rex statement was supposed to be ahead like you mentioned. i also missed the table row in my query, basically querying the same data source. I have a common field documentId, using which trying to join 2 logs so i can get additional fields in my result from the right side query result. index=provisioning_index sourcetype=PCF:log source_type=APP/PROC/WEB message_type=OUT cf_org_name=org1 cf_app_name=app1 LOG_LEVEL="ERROR" service=service1 errorCd="DOC-MGMT*" |rex field=_raw "errorDetails=(?<errorDetails>.*?)\s*:" |fields _time errorCd errorDetails stateCode letterId documentId |join left=lerr right=rlkp type=left where lerr.documentId = rlkp.documentId max=0 [search index=provisioning_index sourcetype=PCF:log source_type=APP/PROC/WEB message_type=OUT cf_org_name=org1 cf_app_name=app1 NOT letterId=null operation=generateInstantDocument |fields _time errorCd errorDetails stateCode letterId documentId] | table _time lerr.errorCd lerr.errorDetails rlkp.stateCode rlkp.letterId lerr.documentId The result i'm seeing that that rlkp.letterId is only populated for few rows and not the whole set. And the volume its search is large/huge.

RamMur · ‎03-12-2025

Hello, I'm trying to join based on a common field using a similar query like below, however, the in the result i only get partial results from the right side, probably because the search volume ( i guess), or may be my query is not right, can we do this without join or properly use join ? TIA index=provisioning_index sourcetype=PCF:log source_type=APP/PROC/WEB message_type=OUT cf_org_name=org1 cf_app_name=APP1 LOG_LEVEL="ERROR" service=service1 errorCd="DOC-MGMT*" |fields _time errorCd errorDetails stateCode letterId documentId |rex field=_raw "errorDetails=(?<errorDetails>.*?)\s*:" |join left=lerr right=rlkp type=left where lerr.documentId = rlkp.documentId max=0 [search index=provisioning_index sourcetype=PCF:log source_type=APP/PROC/WEB message_type=OUT cf_org_name=org1 cf_app_name=APP1 NOT letterId=null operation=generateInstantDocument |fields _time errorCd errorDetails stateCode letterId documentId] | table _time lerr.errorCd lerr.errorDetails rlkp.stateCode rlkp.letterId lerr.documentId

RamMur · ‎07-03-2024

I'm looking to get all failed event log based on a field , and then trying to find the success event log for the same field, so that i have a net failed even log to report. Basically, i'm trying to an alert that i can run every X hours , looking back X hours, and finds me ONLY the failed logs that havent succeeded yet . The failures are retried at regular intervals. In short, get all failed events and weed out the succeeded ones on later retries , so i only have the ones that is still failed. Trying something like below but i think there should be better way than this.. index=sample cf_org_name=orgname service=xyz sourceSystem!="aaa" errorCd="*-701" status=FAILED |where jobNumber NOT IN [search index=sample cf_org_name=orgname service=xyz sourceSystem!="aaa" status=SUCCESS ] |table _time accountNumber jobNumber letterId errorCd |sort _time TIA!!

RamMur · ‎06-28-2024

Afte trying that , it errors out saying "Error in 'search' command: Unable to parse the search: Right hand side of IN must be a collection of literals. '((jobNumber = "3333") OR (jobNumber = "11111") . OR ..."

RamMur · ‎06-27-2024

Hello, I'm fairly new to splunk, trying to search using where clause and filter the results. The query is running long, wondering if i'm not doin this right. a tone down version of the search: index=provisioning_index cf_org_name=abcd cf_app_name=xyz "ReconCount:" |where jobNumber IN ([search index=provisioning_index cf_org_name=abcd cf_app_name=xyz operation="operation1" status=SUCCESS |search NOT jobType="Canc"|table jobNumber ]) |stats count by deliveryInd | addcoltotals

RamMur · ‎06-04-2024

yes, found that my regex had a space between ]], once fixed, was able to extract them as "abc=P, efg=P, HijKlmno=E" , thanks. next trying to get stats on count of abc=P.

RamMur · ‎06-04-2024

trying to use rex to get the contents for the field letterIdAndDeliveryIndicatorMap. For example, Logged string letterIdAndDeliveryIndicatorMap=[abc=P, efg=P, HijKlmno=E] I want to extract the contents between the [] , which is abc=P, efg=P, HijKlmno=E and then find stats on them. I was trying something like rex field=_raw "letterIdAndDeliveryIndicatorMap=\[(?<letterIdAry>[^\] ]+)" but, its not working as expected. Thanks in advance!

Posts	8
Solutions	0
Karma Given	4
Karma Received	0
Member Since	‎06-04-2024

Online Status	Offline
Date Last Visited	‎05-19-2025 12:38 PM

How to Improve a search with Join or suggest alter...

Remove results based on subsearch

Working with where clause

Extracting values inside of a [] , which are , sep...

Re: How to Improve a search with Join or suggest a...

Re: How to Improve a search with Join or suggest a...

How to Improve a search with Join or suggest alter...

Remove results based on subsearch

Re: Working with where clause

Working with where clause

Re: Extracting values inside of a [] , which are ,...

Extracting values inside of a [] , which are , sep...

Are you a member of the Splunk Community?