For each Digit I have below (Digit 0,2,3,4,5,7,8) I want to calculate the difference in time between the TXN endtime and the FW endTime for that digit. How can i group this new calculated one value for each digit? index= jobName = (all job names here) | lookup digit_processing.csv jobName as jobName output Digit as Digit | eval endTimeEpoch = strptime(endTime, "%Y-%m-%d %H:%M:%S") | table jobName Digit endTime endTimeEpoch status | sort -Digit ... View more

I have a search that i only want to have triggered once a day (if it gets a result of course). The issue is that i have to run the alert every 30 minutes within certain hours of the day and if i set a hard-coded throttle it will affect the next days window. And if i dont set a throttle I will get a spam of alerts every 30 mins. I would like to have the alert's throttle reset at 00:00 each day. here is my search , i simply look for a success event for a job, and generates a result index= sourcetype= jobName=theJobName status="SUCCESS" | eval endTimeEpoch = strptime(endTime, "%Y-%m-%d %H:%M:%S") | eval endTime = strftime(endTimeEpoch, "%B %d %Y %H:%M:%S") | eval Platform=case(like(jobName,"jobName here"), "platform name here" ) | table Platform jobName status endTime ... View more

Hello, I need to report on a set of lets say 4 different jobs regardless if there are event results for each one. If there are no events found for any of the jobs i need to evaluate the status as "not complete" For example here is my search index= source= jobName=A OR jobName=B OR jobName=C OR jobName=D | stats latest(statusText) as latestStatus latest(filename) as latestFilename latest(timestamp) as latestTimestamp by jobName | eval feedStatus=if(latestStatus!="SUCCESS", "Filewatch Not complete - Feed may not have been received", "Filewatch Complete") | table jobName latestFilename latestStatus feedStatus latestTimestamp Now I may get results for A, B, C and it will display in my table. But there may be no events found for Job D, nothing will be displayed for that job when in fact it should have a message along with it to evaluate as incomplete. How can I evaluate that there were no search results for this particular job and display it in the same table ? I tried take a count of the search results for each job to evaluate the message when count=0, but nothing display if no events for the particular jobName was found. ... View more

Hello, I have these events where I want to extract a filename. Right now, none of the fields capture the Filename("this is what i want to capture") as a field. Using the regex or delimiter generators from Splunk to produce a new field are not giving me good results, so I believe it is best to write one. Basically, what i want is the information inside the quotes of FileName("") for each event. I indicate it with a red line. ... View more

Hello, I need help with working with some odd styles of time and date values that i am trying to format TransferStartTime = 000036 This means at the 00 hr 00 min 36 second TransferStartDate = 20190325 This means at 2019 year 03 month 25 day So in essence it is basically one clumped value for each time and the date Since this is not epoch, how can i separate the StartTime to display as 00:00:36 and the TransferStartDate as 2019:03:25 ? So it is a lot more clear ... View more

Hello, I have this search that basically gets the longest current running jobs based on logs from a job scheduling system. For ones that are currently "Running", it also calculates the current runtime. This is to keep track of long running jobs. I set this up as an alert to check for jobs running past 4 hours, then it will trigger and give a list of the jobs by email. However..the alert works 90% of the time except when an issue occurs on the server. The alert runs every hour and it is based on the past 3 days worth of logs. This is the error "Unknown error for peer . Search Results might be incomplete. If this occurs frequently, please check on the peer." And it will trigger incomplete results. The splunk admins in our company say the search may need to be optimized, is this actually the case?? index=autosys source= jobName= | where NOT ((LIKE(jobName, "%box%")) OR (LIKE(jobName, "%bx%"))) | stats latest(statusText) AS "latestStatus" latest(timestamp) AS "latestTimestamp" by jobName | where latestStatus="RUNNING" | eval nowstring=strftime(now(), "%Y-%m-%d %H:%M:%S") | eval now = strptime(nowstring,"%Y-%m-%d %H:%M:%S" ) | eval start = strptime(latestTimestamp, "%Y-%m-%d %H:%M:%S") | eval diffInSecs = now-start | eval strSecs=tostring(diffInSecs,"duration") | eval strFormatSecs=if(match(strSecs,"\+"),replace(strSecs,"(\d+)\+(\d+)\:(\d+)\:(\d+)","\1 Day \2 Hr \3 Min \4 Secs"),replace(strSecs,"(\d+)\:(\d+)\:(\d+)","\1 Hr \2 Min \3 Secs")) | eval hour = diffInSecs / 3600 | sort -hour | where (hour > 4) | fields jobName,latestStatus,latestTimestamp,nowstring, strFormatSecs | rename latestStatus As "Status" latestTimestamp As "Job/Box Start Time" nowstring AS "Current Time" strFormatSecs AS "Runtime Days Hrs Min Secs" ... View more

Hello, I have the following search that generates the below table. How do i get the starting timestamp and the Success or Failure timestamp in the same row as the starting timestamp when these values are all in separate events (one event has start time of job X, next has success/failure time of job X). They will also need to be associated in the right order. index=XXX source=XXX jobName=XXX | where statusText="SUCCESS" or statusText="STARTING" or statusText="FAILURE" | eval startTime=if(statusText=="STARTING",timestamp,null) | eval failureTime=if(statusText=="FAILURE",timestamp,null) | eval successTime=if(statusText=="SUCCESS",timestamp,null) | table jobName startTime successTime failureTime | rename startTime as "Start Time" successTime as "Success Time" failureTime as "Failure Time" ... View more