Splunk Search

Get the latest event status of the Jobs (re-submitted repeatedly)

arulbalans
Engager

Splunk Query:

2016-06-12 00:48:29,834 INFO  [MainThread][PID:3143] item: AR001SJFBS valid_audio_path: /PROXY_AUDIO/2011/05/31/AR001SJFBS_3.mp2||/PROXY_AUDIO/2011/05/31/AR001SJFBS_4.mp2
2016-06-12 00:48:29,834 INFO  [MainThread][PID:3143] Item Submitted :: AR001SJFBS
2016-06-12 00:48:40,730 INFO  [MainThread][PID:3143] Item Processed :: AR001SJFBS, Transcode Status :: error

2016-06-27 08:30:20,169 INFO  [MainThread][PID:29112] item: AR001SJFBS valid_audio_path: /PROXY_AUDIO/2011/05/31/AR001SJFBS_3.mp2||/PROXY_AUDIO/2011/05/31/AR001SJFBS_4.mp2
2016-06-27 08:30:20,169 INFO  [MainThread][PID:29112] Item Submitted :: AR001SJFBS
2016-06-27 08:51:56,680 INFO  [MainThread][PID:29112] update metadat:: file system check True, new access path L:\PROXY\2011\05\31\AR001SJFBS.mp4
2016-06-27 08:52:13,879 INFO  [MainThread][PID:29112] Existing proxy backup at P:\MPEG_Backup\PROXY\2011\05\31\AR001SJFBS.mpeg ::
2016-06-27 08:52:13,879 INFO  [MainThread][PID:29112] Item Processed :: AR001SJFBS, Transcode Status :: completed 

From the above log
I'm re-submitting jobs that are failed with error/aborted/failed status. So possibilities of repeated proxies are present in the list.
I have to treat the transcode status of "AR001SJFBS" as "completed" instead "error" since completed is the latest status.

Thanks, Arul

0 Karma
1 Solution

sundareshr
Legend

Try this

... | rex "PID:(?<job>\d+)\]\sItem\s(|?<status>\w+)" | eval status=if(status="AR*", "Completed", status) | stats latest(status) as status by job

View solution in original post

0 Karma

sundareshr
Legend

Try this

... | rex "PID:(?<job>\d+)\]\sItem\s(|?<status>\w+)" | eval status=if(status="AR*", "Completed", status) | stats latest(status) as status by job
0 Karma

arulbalans
Engager

Thank you Sundaresh!

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...