About mightaswelby

mightaswelby · ‎06-05-2019

worked perfect, thank you!

mightaswelby · ‎06-05-2019

Having an issue with a linebreak. Seems most events are breaking properly, but a small number are not. I think this may be due to the ',' following the capture, which is inconsistent in the logs. Any suggestions to break on this for the remaining events not working? Existing props.conf [ ] SHOULD_LINEMERGE=true LINE_BREAKER=StandartDeviation=NaN NO_BINARY_CHECK=true CHARSET=UTF-8 disabled=false Raw Data: (**bolded** instances not breaking properly) 2019-06-05 09:35:33,617 - AOB:com.fnf.xes.PRF:IntRateInqRq=ServiceName=IntRateInqRq, ChannelName=AOB, SPName=com.fnf.xes.PRF, successCount=0, successTotalTime=0, successMinTime=0, sucssessMaxTime=0, sqrSuccessTotalTime=0, Id=IntRateInqRq, TotalCount=1, TotalTime=84, TotalMinTime=84, TotalMaxTime=84, TotalAvgTime=84.0, **StandartDeviation=NaN,** null:com.fnis.xes.PRF:com.fnis.ifx.xbo.v1_1.commondata.CommonDataXQO=ServiceName=com.fnis.ifx.xbo.v1_1.commondata.CommonDataXQO, ChannelName=null, SPName=com.fnis.xes.PRF, successCount=0, successTotalTime=0, successMinTime=0, sucssessMaxTime=9, sqrSuccessTotalTime=0, Id=com.fnis.ifx.xbo.v1_1.commondata.CommonDataXQO, TotalCount=2, TotalTime=20, TotalMinTime=9, TotalMaxTime=11, TotalAvgTime=10.0, StandartDeviation=NaN 2019-06-05 09:54:23,352 - null:null:IFXServiceBase=EndPointName=IFXServiceBase, Protocol=null, ReqMsgTotalLength=0, ReqMinLength=0, ReqMaxLength=0, ResMsgTotalLength=0, ResMinLength=0, ResMaxLength=0, ServiceName=IFXServiceBase, ChannelName=null, SPName=null, successCount=0, successTotalTime=0, successMinTime=0, sucssessMaxTime=68, sqrSuccessTotalTime=0, Id=IFXServiceBase, TotalCount=3, TotalTime=217, TotalMinTime=68, TotalMaxTime=81, TotalAvgTime=72.0, StandartDeviation=NaN 2019-06-05 09:48:51,991 - AOB:com.fnf.xes.PRF:IntRateInqRq=ServiceName=IntRateInqRq, ChannelName=AOB, SPName=com.fnf.xes.PRF, successCount=0, successTotalTime=0, successMinTime=0, sucssessMaxTime=0, sqrSuccessTotalTime=0, Id=IntRateInqRq, TotalCount=1, TotalTime=63, TotalMinTime=63, TotalMaxTime=63, TotalAvgTime=63.0, **StandartDeviation=NaN,** null:com.fnis.xes.PRF:com.fnis.ifx.xbo.v1_1.commondata.CommonDataXQO=ServiceName=com.fnis.ifx.xbo.v1_1.commondata.CommonDataXQO, ChannelName=null, SPName=com.fnis.xes.PRF, successCount=0, successTotalTime=0, successMinTime=0, sucssessMaxTime=35, sqrSuccessTotalTime=0, Id=com.fnis.ifx.xbo.v1_1.commondata.CommonDataXQO, TotalCount=2, TotalTime=68, TotalMinTime=33, TotalMaxTime=35, TotalAvgTime=34.0, StandartDeviation=NaN 2019-06-05 09:48:51,991 - null:null:SOAP_IFX20=EndPointName=SOAP_IFX20, Protocol=null, ReqMsgTotalLength=0, ReqMinLength=0, ReqMaxLength=0, ResMsgTotalLength=0, ResMinLength=0, ResMaxLength=0, ServiceName=SOAP_IFX20, ChannelName=null, SPName=null, successCount=0, successTotalTime=0, successMinTime=0, sucssessMaxTime=38, sqrSuccessTotalTime=0, Id=SOAP_IFX20, TotalCount=2, TotalTime=74, TotalMinTime=36, TotalMaxTime=38, TotalAvgTime=37.0, **StandartDeviation=NaN,** null:null:IFXServiceBase=EndPointName=IFXServiceBase, Protocol=null, ReqMsgTotalLength=0, ReqMinLength=0, ReqMaxLength=0, ResMsgTotalLength=0, ResMinLength=0, ResMaxLength=0, ServiceName=IFXServiceBase, ChannelName=null, SPName=null, successCount=0, successTotalTime=0, successMinTime=0, sucssessMaxTime=0, sqrSuccessTotalTime=0, Id=IFXServiceBase, TotalCount=1, TotalTime=67, TotalMinTime=67, TotalMaxTime=67, TotalAvgTime=67.0, StandartDeviation=NaN 2019-06-05 09:45:33,617 - AOB:com.fnf.xes.PRF:IntRateInqRq=ServiceName=IntRateInqRq, ChannelName=AOB, SPName=com.fnf.xes.PRF, successCount=0, successTotalTime=0, successMinTime=0, sucssessMaxTime=81, sqrSuccessTotalTime=0, Id=IntRateInqRq, TotalCount=2, TotalTime=141, TotalMinTime=60, TotalMaxTime=81, TotalAvgTime=70.0, StandartDeviation=NaN 2019-06-05 09:45:33,617 - null:null:IFXServiceBase=EndPointName=IFXServiceBase, Protocol=null, ReqMsgTotalLength=0, ReqMinLength=0, ReqMaxLength=0, ResMsgTotalLength=0, ResMinLength=0, ResMaxLength=0, ServiceName=IFXServiceBase, ChannelName=null, SPName=null, successCount=0, successTotalTime=0, successMinTime=0, sucssessMaxTime=86, sqrSuccessTotalTime=0, Id=IFXServiceBase, TotalCount=2, TotalTime=150, TotalMinTime=64, TotalMaxTime=86, TotalAvgTime=75.0, StandartDeviation=NaN 2019-06-05 09:44:23,352 - null:com.fnis.xes.PRF:com.fnis.ifx.xbo.v1_1.commondata.CommonDataXQO=ServiceName=com.fnis.ifx.xbo.v1_1.commondata.CommonDataXQO, ChannelName=null, SPName=com.fnis.xes.PRF, successCount=0, successTotalTime=0, successMinTime=0, sucssessMaxTime=10, sqrSuccessTotalTime=0, Id=com.fnis.ifx.xbo.v1_1.commondata.CommonDataXQO, TotalCount=2, TotalTime=20, TotalMinTime=10, TotalMaxTime=10, TotalAvgTime=10.0, StandartDeviation=NaN 2019-06-05 09:44:23,352 - null:null:SOAP_IFX20=EndPointName=SOAP_IFX20, Protocol=null, ReqMsgTotalLength=0, ReqMinLength=0, ReqMaxLength=0, ResMsgTotalLength=0, ResMinLength=0, ResMaxLength=0, ServiceName=SOAP_IFX20, ChannelName=null, SPName=null, successCount=0, successTotalTime=0, successMinTime=0, sucssessMaxTime=12, sqrSuccessTotalTime=0, Id=SOAP_IFX20, TotalCount=2, TotalTime=24, TotalMinTime=12, TotalMaxTime=12, TotalAvgTime=12.0, StandartDeviation=NaN 2019-06-05 09:38:51,991 - AOB:com.fnf.xes.PRF:IntRateInqRq=ServiceName=IntRateInqRq, ChannelName=AOB, SPName=com.fnf.xes.PRF, successCount=0, successTotalTime=0, successMinTime=0, sucssessMaxTime=72, sqrSuccessTotalTime=0, Id=IntRateInqRq, TotalCount=2, TotalTime=142, TotalMinTime=70, TotalMaxTime=72, TotalAvgTime=71.0, StandartDeviation=NaN

mightaswelby · ‎10-13-2017

Trying to compare response time from yesterday to today. This search seems to be working, but very, very slow. Any suggestions on how to improve it? sourcetype=prd_banking_server Bank_Code = 108 earliest=@d latest=now | eval Duration_Sec = duration/1000 | multikv | eval ReportKey="Today" | append [search sourcetype=prd_banking_server Bank_Code = 108 earliest=-1d@d latest=-24@h | eval Duration_Sec = duration/1000 | multikv | eval ReportKey="Yesterday" | eval _time=_time+(60*60*24*7)] | timechart span=60m avg(Duration_Sec) by ReportKey

mightaswelby · ‎10-11-2017

I'm having some issues with linebreaks in one of our logs. I used LINE_BREAKER = WSDL(,\s*) that covered most of the log format, however I'm still having some issues with random events. Anyone have any recommendations? I've identified the one's giving me issue in bold. 10N,MAH012,,10N~EC_CUST~ECRetrieveAndSyncLoginProfile~4.0.0,10.20.94.58 ,05abab50-adb2-11e7-9a43-bb5578ba9891,,2017-10-10-06:56:16.912000,2017-10-10-06:56:18.154000,1242,MB00000,"Success",,780,13812,WSDLV2Hdr, kb1,KEYBANK,,kb1~EB~AuditSignOn~v1.3.0,156.77.52.102 ,67b30467-c667-412b-9c50-c5033bfd2f15,da44ffe7-c9dd-4786-a7d9-09d720cdb569,2017-10-10-06:56:17.708000,2017-10-10-06:56:18.442000,734,0,"Success",,918,1032,WSDL, C98,CRD006,ZC98004,DEFAULT~CB~CBAcctInq~12.0,10.155.52.6 ,e90fc717-cee4-4c4c-9205-c88c6a0b5656,e90fc717-cee4-4c4c-9205-c88c6a0b5656,2017-10-10-06:56:18.384000,2017-10-10-06:56:18.611000,227,0,,,386,2376,WSDL, KeyBank,MVEPAY,,KeyBank~EB~EBFundsVerification~1.0,10.20.97.16 ,E44cdAC0-d4EB-4393-8Abb-0AaC0b0b124d,ddD630aa-688E-4bc0-8BC8-f9e0bc72f0eE,2017-10-10-06:56:18.783000,2017-10-10-06:56:19.003000,220,0,"Success",,945,651,WSDL, G1U,CRD006,WG1U099,DEFAULT~CB~CBHoldListInq~1.0,10.142.187.1 ,30e0ee4e-66ea-42bd-a975-f6f5661dbf36,30e0ee4e-66ea-42bd-a975-f6f5661dbf36,2017-10-10-06:56:19.023000,2017-10-10-06:56:19.037000,14,0,,,537,552,HTTP, 165,FTO290,E165660,DEFAULT~CI~CIUsrDefPrfl~16.0,10.188.218.252 ,a96ebc5b-9e51-4212-ab4d-095968afa031,,2017-10-10-06:56:19.422000,2017-10-10-06:56:19.583000,161,0,,,626,4994,WSDL, 552,BAS013,R552025,DEFAULT~LN~LNKywrd~1.0,10.167.77.6 ,96f1a14f-c5d1-46f3-8963-6240b295ab08,96f1a14f-c5d1-46f3-8963-6240b295ab08,2017-10-10-06:56:19.765000,2017-10-10-06:56:20.034000,269,0,,,435,483,WSDL, 552,BAS013,R552025,DEFAULT~DP~DPHoldInq~2.0,10.167.77.6 ,f148beff-1ba5-4d2e-8198-fdf17d83153b,f148beff-1ba5-4d2e-8198-fdf17d83153b,2017-10-10-06:56:20.280000,2017-10-10-06:56:20.294000,14,-1,,,402,707,WSDL, 552,BAS013,R552025,DEFAULT~DP~DPAcctTxnInq~3.0,10.167.77.6 ,5b3b80da-9f1b-434b-b580-9b29259a9245,5b3b80da-9f1b-434b-b580-9b29259a9245,2017-10-10-06:56:20.294000,2017-10-10-06:56:20.330000,36,0,,,477,2266,WSDL, 184,ISM460,W184519,DEFAULT~CI~CIUsrDefPrfl~18.0,10.92.26.29 ,d2c90885-e67f-4550-9e86-f8a74c247e27,bf7d61d8-b7b1-48fb-b48c-56cf62096499,2017-10-10-06:56:20.435000,2017-10-10-06:56:20.465000,30,-1,,,552,869,WSDL, 552,BAS013,R552025,DEFAULT~LN~LNNoteListInq~2.0,10.167.77.6 ,18563f9c-9cb8-4c7d-b6cd-59cd70fe8f16,18563f9c-9cb8-4c7d-b6cd-59cd70fe8f16,2017-10-10-06:56:20.640000,2017-10-10-06:56:20.914000,274,0,,,392,1711,WSDL, 552,BAS013,R552025,DEFAULT~DP~DPNmeAddrInq~1.0,10.167.77.6 ,a3a0ad97-ca2c-4079-9722-8dfc887e60a5,a3a0ad97-ca2c-4079-9722-8dfc887e60a5,2017-10-10-06:56:20.748000,2017-10-10-06:56:21.014000,266,0,,,389,772,WSDL, 552,BAS013,R552025,DEFAULT~DP~DPIntradayInq~3.0,10.167.77.6 ,592eb925-6ed0-410a-bad8-f062d655de09,592eb925-6ed0-410a-bad8-f062d655de09,2017-10-10-06:56:21.160000,2017-10-10-06:56:21.178000,18,0,,,394,991,WSDL, 10N,MAH012,,10N~EC_CUST~ECRetrieveAndSyncLoginProfile~4.0.0,10.20.94.58 ,07139fc0-adb2-11e7-9ab9-bb5578ba9891,,2017-10-10-06:56:19.270000,2017-10-10-06:56:21.390000,2120,MB00000,"Success",,780,17606,WSDLV2Hdr, kb1,KEYBANK,,kb1~EB~GetFundingAccountDetails~v1.3.0,156.77.52.102 ,23853d93-de0d-465d-aff3-1e91cb43a42f,28220af4-c488-4335-b183-6d6b89e53d12,2017-10-10-06:56:21.299000,2017-10-10-06:56:21.598000,299,0,"Success",,458,2942,WSDL, 136,GO,A136C93,136~BI~ExternInterop~2.0,10.20.94.151 ,6fc8a0a6-8fd8-4d2c-845b-be7ce7b7b9b4,6fc8a0a6-8fd8-4d2c-845b-be7ce7b7b9b4,2017-10-10-06:56:15.005000,2017-10-10-06:56:15.025000,20,0,"Success",Get Interop Request,706,2843,SSO2, 762,ONE695,W762998,DEFAULT~CB~CBPndATMPOSTxnInq~1.0,10.92.1.37 ,3d30c60e-66c7-4c08-94bc-86bb023f1fb1,5b91a0ff-bb7b-45ce-9270-5a528f51175e,2017-10-10-06:56:15.223000,2017-10-10-06:56:15.456000,233,0,,,411,393,WSDL, 10N,MAH012,,10N~EC_CUST~ECRetrieveAndSyncLoginProfile~4.0.0,10.20.94.63 ,04554310-adb2-11e7-b340-ad2c5e3e144f,,2017-10-10-06:56:14.671000,2017-10-10-06:56:15.805000,1134,MB00000,"Success",,780,9264,WSDLV2Hdr, 236075689,ONE696,,236075689~XP~XPRetrieveAcctSummary~1.8.1,10.237.41.19 ,a9c08568-7d21-4eaa-b094-3b1f3a458b8e,Retrieve Account Balance Data,2017-10-10-06:56:16.134000,2017-10-10-06:56:16.364000,230,MB00000,"Success",,353,3376,WSDLV2Hdr, G1U,CRD006,WG1U099,DEFAULT~CB~CBAcctInq~3.0,10.142.187.1 ,e00ddbbd-08c1-44bc-bddf-e6518ad6ff1f,e00ddbbd-08c1-44bc-bddf-e6518ad6ff1f,2017-10-10-06:56:16.899000,2017-10-10-06:56:17.193000,294,0,,,462,1988,HTTP, 255,glj767,V255008,DEFAULT~CB~CBPndATMPOSTxnInq~2.0,10.52.9.12 ,4db9cba8-16d3-4bbf-909d-5ba181f34fe4,d3bcb4d1-078d-4fae-9e77-687e8a394e03,2017-10-10-06:56:17.568000,2017-10-10-06:56:17.812000,244,0,,,410,392,WSDL, CNTRSTBK,BeB,,DEFAULT~EAM~TMSessionQuery~2.0,10.236.114.31 ,9cd5bc4b-76ee-47a7-8d0a-e4bc5044f666,,2017-10-10-06:56:09.292000,2017-10-10-06:56:09.451000,159,MB00000,"Success",,697,1329,WSDLV2Hdr, 071174431,SFEPAY,S852018,071174431~EB~GetFundingAccountDetails~v1.2.0,10.189.1.6 ,12f5ec2d-9cfd-49a3-b7e3-9b494a74f00d,12f5ec2d-9cfd-49a3-b7e3-9b494a74f00d,2017-10-10-06:56:09.597000,2017-10-10-06:56:09.804000,207,0,"Success",,519,1272,WSDL, 446,ONE695,B446997,DEFAULT~CB~CBPndATMPOSTxnInq~1.0,10.92.1.34 ,99d47f01-74c7-48e6-ace3-25554edbf4cc,8a386f10-1492-4ea9-a309-00a1e4707731,2017-10-10-06:56:10.053000,2017-10-10-06:56:10.071000,18,0,,,408,390,WSDL, 10N,MAH012,,10N~EC_CUST~ECRetrieveAndSyncLoginProfile~4.0.0,10.20.94.63 ,010a0fb0-adb2-11e7-b29e-ad2c5e3e144f,,2017-10-10-06:56:09.143000,2017-10-10-06:56:10.226000,1083,MB00000,"Success",,780,6470,WSDLV2Hdr, 552,BAS013,R552025,DEFAULT~DP~DPIntradayInq~3.0,10.167.77.6 ,1e2334da-bc27-4339-9bf1-eba82fa3fb06,1e2334da-bc27-4339-9bf1-eba82fa3fb06,2017-10-10-06:56:05.105000,2017-10-10-06:56:05.408000,303,0,,,392,975,WSDL, 10N,MAH012,,10N~EC_CUST~ECRetrieveAndSyncLoginProfile~4.0.0,10.20.94.59 ,fe3ee1c0-adb1-11e7-979a-89219c5c52d0,,2017-10-10-06:56:04.457000,2017-10-10-06:56:05.511000,1054,MB00000,"Success",,780,7050,WSDLV2Hdr, 951-G4X,PCS010,W951HK3,DEFAULT~CB~CBHoldListInq~2.0,10.236.24.193 ,3a2955d2-25f1-4418-a7ea-420269cbe566,f3a07b00-a26b-415e-8b38-fa12bcb8f1a3,2017-10-10-06:56:05.765000,2017-10-10-06:56:05.779000,14,0,,,418,950,HTTP, 255,glj767,V255008,DEFAULT~DP~DPAcctBalInq~2.0,10.52.9.12 ,f7e881dd-f567-43ea-a486-7f94c5f010af,2a29af88-4926-4fb7-8372-7e5d56f43449,2017-10-10-06:56:06.133000,2017-10-10-06:56:06.168000,35,0,,,388,564,WSDL, 951-G4X,PCS010,W951HK3,DEFAULT~CB~CBNotesInqAndMaint~1.0,10.236.24.193 ,79597520-2105-4d73-bc2f-eaa0f58e9f2a,9944bad2-d399-458d-bbf9-679dd674ede7,2017-10-10-06:56:06.438000,2017-10-10-06:56:06.457000,19,0,,,433,545,HTTP, 552,BAS013,R552025,DEFAULT~DP~DPNmeAddrInq~1.0,10.167.77.6 ,6e4621b9-1898-4063-90ee-8f11988c8eba,6e4621b9-1898-4063-90ee-8f11988c8eba,2017-10-10-06:56:06.229000,2017-10-10-06:56:06.504000,275,0,,,390,740,WSDL, C98,CRD006,ZC98004,DEFAULT~CB~CBAcctInq~12.0,10.155.52.6 ,e90fc717-cee4-4c4c-9205-c88c6a0b5656,e90fc717-cee4-4c4c-9205-c88c6a0b5656,2017-10-10-06:56:06.825000,2017-10-10-06:56:07.081000,256,0,,,386,2367,WSDL, 165,FTO290,E165660,DEFAULT~DL~DLMultAcctBalInq~3.0,10.188.218.252 ,317f9007-a09b-4d10-a630-f40c93bc6f88,,2017-10-10-06:56:02.602000,2017-10-10-06:56:02.634000,32,0,,,582,3864,WSDL, 552,BAS013,R552025,DEFAULT~DP~DPPriorDayInq~6.0,10.167.77.6 ,cadca361-29cc-4ecc-85a7-3760e3fd23ab,cadca361-29cc-4ecc-85a7-3760e3fd23ab,2017-10-10-06:56:02.833000,2017-10-10-06:56:03.084000,251,0,,,510,4934,WSDL, 552,BAS013,R552025,DEFAULT~CI~CIAcctPrfl~7.0,10.167.77.6 ,27b6638c-74e8-4638-ace0-2448f6d910de,27b6638c-74e8-4638-ace0-2448f6d910de,2017-10-10-06:56:02.772000,2017-10-10-06:56:03.134000,362,0,,,399,2497,WSDL, 072410013,ONE696,,072410013~XP~XPRetrieveAcctSummary~1.8.1,10.237.41.20 ,d3de0e5e-76a2-4f71-83c1-0bf705bcef3c,Retrieve Account Balance Data,2017-10-10-06:56:02.952000,2017-10-10-06:56:03.137000,185,MB00000,"Success",,353,3178,WSDLV2Hdr, C98,CRD006,ZC98004,DEFAULT~CB~CBCardPinInq~2.0,10.155.52.6 ,e90fc717-cee4-4c4c-9205-c88c6a0b5656,e90fc717-cee4-4c4c-9205-c88c6a0b5656,2017-10-10-06:56:03.157000,2017-10-10-06:56:03.173000,16,0,,,397,1088,WSDL, 552,ONE695,K552997,DEFAULT~DP~DPIntradayInq~2.0,10.92.1.35 ,7958f9fb-8480-40fc-933e-fa8adec96d2a,e9e94e6c-8fc8-4f7e-a2f7-6acb29a593c8,2017-10-10-06:56:03.405000,2017-10-10-06:56:03.434000,29,0,,,428,1036,WSDL, C98,CRD006,ZC98004,DEFAULT~CB~CBCardHolderInq~2.0,10.155.52.6 ,e90fc717-cee4-4c4c-9205-c88c6a0b5656,e90fc717-cee4-4c4c-9205-c88c6a0b5656,2017-10-10-06:56:03.802000,2017-10-10-06:56:03.831000,29,0,,,409,1202,WSDL, 552,BAS013,R552025,DEFAULT~CI~CIRmrkInq~1.0,10.167.77.6 ,7054b464-16e3-4507-a73f-edba52bdaaef,7054b464-16e3-4507-a73f-edba52bdaaef,2017-10-10-06:56:04.575000,2017-10-10-06:56:04.601000,26,0,,,439,408,WSDL, 10N,MAH012,,10N~EC_CUST~ECRetrieveAndSyncLoginProfile~4.0.0,10.20.94.58 ,fda3b330-adb1-11e7-98be-bb5578ba9891,,2017-10-10-06:56:03.437000,2017-10-10-06:56:04.613000,1176,MB00000,"Success",,780,12043,WSDLV2Hdr, 072410013,ONE696,,072410013~XP~XPRetrieveAcctSummary~1.8.1,10.237.41.24 ,84f1a0b0-17bd-41ef-99fc-e6a26bddf780,Retrieve Account Balance Data,2017-10-10-06:56:04.575000,2017-10-10-06:56:04.783000,208,MB00000,"Success",,353,3156,WSDLV2Hdr, kb1,KEYBANK,,kb1~EB~GetConsumerPayeeDetails~v1.3.0,156.77.52.102 ,db498309-1731-4430-b81e-eec6bfba2489,1d001e3f-90bd-4ab8-b7bf-912df54ed9f3,2017-10-10-06:56:03.725000,2017-10-10-06:56:04.869000,1144,0,"Success",,455,76350,WSDL, 552,BAS013,R552025,DEFAULT~DP~DPKywrd~1.0,10.167.77.6 ,57e26eb6-54f8-4b99-9378-739dfad61fd4,57e26eb6-54f8-4b99-9378-739dfad61fd4,2017-10-10-06:56:05.092000,2017-10-10-06:56:05.108000,16,0,,,435,646,WSDL, C98,CRD006,ZC98004,DEFAULT~CB~CBCardHolderInq~2.0,10.155.52.6 ,e90fc717-cee4-4c4c-9205-c88c6a0b5656,e90fc717-cee4-4c4c-9205-c88c6a0b5656,2017-10-10-06:56:05.030000,2017-10-10-06:56:05.380000,350,0,,,409,1184,WSDL, 10N,CeB,,10N~EC_CUST~ECRetrieveAndSyncLoginProfile~4.0.0,10.92.1.157 ,fd34ebd0-adb1-11e7-b21e-8257f48e3dd6,,2017-10-10-06:56:02.720000,2017-10-10-06:56:03.964000,1244,MB00000,"Success",,780,14829,WSDLV2Hdr, kb1,KEYBANK,,kb1~EB~GetPaymentDetails~v1.3.0,156.77.52.100 ,7f4997f1-55eb-448e-80df-c48e9b689a8c,259924aa-527a-4a11-872c-4851a02e49e9,2017-10-10-06:56:04.098000,2017-10-10-06:56:04.336000,238,0,"Success",,651,6536,WSDL, GI5,CRD006,CGI5103,DEFAULT~CB~CBHoldListInq~2.0,10.155.170.10 ,2b32af37-66e0-4188-a058-ca405a283057,ca8542a4-4506-423f-8bda-9ecc3a8de212,2017-10-10-06:56:04.364000,2017-10-10-06:56:04.381000,17,0,,,460,552,WSDL, kb1,KEYBANK,,kb1~EB~AddPayment~v1.3.0,156.77.52.104 ,08f21ba6-72b0-4100-ac78-53c3c6feef5e,d190e7ed-c181-4191-8fe3-576e39de0dfc,2017-10-10-06:56:01.778000,2017-10-10-06:56:04.401000,2623,0,"Success",,1393,2461,WSDL, 031100102,CEB,,031100102~EB_PP~GetPaymentDetails~v1.5.0,10.92.1.159 ,fe32d3d0-adb1-11e7-aede-940104d375b3,,2017-10-10-06:56:04.389000,2017-10-10-06:56:04.637000,248,0,"Success",,828,551,WSDL, 552,BAS013,R552025,DEFAULT~CI~CIRmrkInq~1.0,10.167.77.6 ,e8e54ec1-2430-4e06-bcba-5f0d27923d8b,e8e54ec1-2430-4e06-bcba-5f0d27923d8b,2017-10-10-06:56:04.601000,2017-10-10-06:56:04.900000,299,0,,,440,408,WSDL, 552,BAS013,R552025,DEFAULT~LN~LNNotePaySchedInq~1.0,10.167.77.6 ,c83ddeb3-f405-4712-bc85-4e0c80589131,c83ddeb3-f405-4712-bc85-4e0c80589131,2017-10-10-06:56:04.591000,2017-10-10-06:56:04.900000,309,0,,,426,961,WSDL, 552,BAS013,R552025,DEFAULT~DP~DPStopPayInq~2.0,10.167.77.6 ,702cd169-cfa1-47df-89e2-1dd61176269c,702cd169-cfa1-47df-89e2-1dd61176269c,2017-10-10-06:56:05.108000,2017-10-10-06:56:05.120000,12,0,,,417,456,WSDL, 992,ONE695,W992998,DEFAULT~CB~CBPndATMPOSTxnInq~1.0,10.92.1.37 ,13a047bc-7412-4738-9af3-05f8caedd06a,0b05b540-c792-40f4-938c-c9582e734e7e,2017-10-10-06:56:05.120000,2017-10-10-06:56:05.134000,14,0,,,408,390,WSDL, 136,ONE695,B136997,DEFAULT~DP~DPIntradayInq~2.0,10.92.1.35 ,d4ae52cd-6143-47a2-9f87-9f7b0f1a144c,0bb20fb2-17dc-4293-b863-38d9ba7cf2c6,2017-10-10-06:56:05.221000,2017-10-10-06:56:05.498000,277,0,,,428,1022,WSDL, C98,CRD006,ZC98004,DEFAULT~CB~CBAcctInq~12.0,10.155.52.6 ,e90fc717-cee4-4c4c-9205-c88c6a0b5656,e90fc717-cee4-4c4c-9205-c88c6a0b5656,2017-10-10-06:56:05.353000,2017-10-10-06:56:05.581000,228,0,,,386,2337,WSDL, 552,BAS013,R552025,DEFAULT~CI~CIRmrkInq~1.0,10.167.77.6 ,8d1ac610-3440-4bc0-a1ed-67ed7f8e2af2,8d1ac610-3440-4bc0-a1ed-67ed7f8e2af2,2017-10-10-06:56:05.948000,2017-10-10-06:56:05.964000,16,0,,,439,408,WSDL, 992,ONE695,W992998,DEFAULT~CB~CBPndATMPOSTxnInq~1.0,10.92.1.37 ,338e093f-893e-4fa0-acaa-f0cf37d6694a,b1b89110-65a8-4d51-9c5f-84b8d855db18,2017-10-10-06:56:06.100000,2017-10-10-06:56:06.112000,12,0,,,408,390,WSDL, 255,glj767,V255008,DEFAULT~DP~DPTxnInq~3.0,10.52.9.12 ,2a28354b-84da-4d13-bb05-d873e1c0fe84,5d984cfa-ff9c-4807-ba07-ffce93718c73,2017-10-10-06:56:06.088000,2017-10-10-06:56:06.120000,32,0,,,435,29410,WSDL, 552,BAS013,R552025,DEFAULT~CI~CIAcctPrfl~7.0,10.167.77.6 ,767f1a1e-1930-49ea-af4b-372de0ceaff9,767f1a1e-1930-49ea-af4b-372de0ceaff9,2017-10-10-06:56:06.365000,2017-10-10-06:56:06.399000,34,0,,,401,1272,WSDL,

mightaswelby · ‎07-14-2017

This seemed to work perfectly, thank you somesoni2

mightaswelby · ‎07-13-2017

Thanks for the response somesoni2, however in order to produce the accurate value, the | stats sum(CPU %) needs to be included in the query. (issues with the way windows perfmon passes cpu data). looking to timechart the result sum(CPU % over a period of time and having no luck. sourcetype=Script:RunningProc eventtype=Security-proc1 | appendpipe [stats avg(CPUPct) as "CPU %" by Instance] | stats sum(CPU %) output: sum(CPU %) 0.156074

mightaswelby · ‎07-13-2017

Able to get the expected value running this query, however how would I plot this over time as a timechart? sourcetype=Script:RunningProc eventtype=Security-proc1 | appendpipe [stats avg(CPUPct) as "CPU %" by Instance] | stats sum(CPU %) output: sum(CPU %) 0.156074

mightaswelby · ‎07-12-2017

I was able to get the results need doing a subsearch. index="perfmon" (sourcetype=Perfmon:Process OR sourcetype=Perfmon:CPU counter="% Processor Time") | eval cpu_by_process=process_cpu_used_percent / [search sourcetype="Script:ProcessorCount" host="*" | return $NumberOfLogicalProcessors]

mightaswelby · ‎07-11-2017

Thanks for the response MuS. Yes, I did verify the select all fields. The NumberOfLogicalProcessors is a numeric field, that is where I am running into the issue. This value will be dynamic based on the client server Processor Number count. (this works if I divide by a static number in the eval eg: | eval cpu_by_process = process_cpu_used_percent / 4 And when I run the search (without the eval) I am able to see both fields without issue, NumberOfLogicalProcessors AND process_cpu_used_percent. I'm just not sure how to approach this one.

mightaswelby · ‎07-11-2017

I am trying to get a representation of the percentage of CPU used per windows process based on the amount of processors per client server. To accomplish this I am looking to divide one field value (process_cpu_used_percent) by another field value (NumberOfLogicalProcessors) to get the final percentage of cpu used by process (based on the number of processors). I have written the following search to create the new field (cpu_by_process), however I do not see it listed in the Fields after I run the search. Should I be using a stats command instead? Note: Most fields are using the standard perfmon metrics from the Splunk Add-on for Microsoft Windows (https://splunkbase.splunk.com/app/742/) I've created a Powershell script that populates Splunk with the number of Logical Processors per client server to get this baseline, with a field name of NumberOfLogicalProcessors. Below is the search I have created, however the eval does not seem to be working properly by dividing the process CPU used by the number of processors per client server. index="perfmon" (sourcetype=Perfmon:Process OR sourcetype=Perfmon:CPU counter="% Processor Time") OR sourcetype=Script:ProcessorCount host=LTJ09OKDU | eval cpu_by_process = process_cpu_used_percent / NumberOfLogicalProcessors

Posts	10
Solutions	1
Karma Given	2
Karma Received	1
Member Since	‎04-16-2013

Online Status	Offline
Date Last Visited	‎08-05-2024 06:43 PM

Linebreaking problem on a small amount of events

compare response time from yesterday to today

More linebreaking issues

Trying to chart process over time unsuccessfully w...

Windows CPU by Process - How do I divide field val...

Re: Linebreaking problem on a small amount of even...