About Renunaren

Renunaren

Hi ITWhisperer, Thank you for your response. But the query which you have provided is eliminating the job name that contains NODATA string, but we only need that job name that contains NODATA string, rest all jobs, we can eliminate. Kindly help us on this. Thank you

Renunaren

Hi Team, Good day! We have extracted the set of job names from the event using the below rex query. index=app_events_dwh2_de_uat _raw=*jobname* | rex max_match=0 "\\\\\\\\\\\\\"jobname\\\\\\\\\\\\\":\s*\\\\\\\\\\\\\"(?<Name>[^\\\]+).*?\\\\\\\\\\\\\"status\\\\\\\\\\\\\":\s*\\\\\\\\\\\\\"(?<State>ENDED OK).*?Timestamp\\\\\\\\\\\\\": \\\\\\\\\\\\\"(?<TIME>\d+\s*\d+\:\d+\:\d+).*?execution_time_in_seconds\\\\\\\\\\\\\": \\\\\\\\\\\\\"(?<EXECUTION_TIME>[\d\.\-]+)" | table "TIME", "Name", "State", "EXECUTION_TIME" | mvexpand TIME | dedup TIME After using the above query we have obtained the result in the table format like below. 20240417 21:13:23 CONTROL_M_REPORT ENDED OK 73.14 DWHEAP_FW_BHW ENDED OK 80.66 DWHEAP_FW_TALANX ENDED OK 80.18 DWHEAP_TALANX_LSP_FW_NODATA ENDED OK 3.25 SALES_EVENT_TRANSACTION_RDV ENDED OK 141.41 Is it possible to extract only the jobs with name consists of string NODATA from the above set of job names. Below is the sample event for the above one. Dataframe row : {"_c0":{"0":"{","1":" \"0\": {","2":" \"jobname\": \"CONTROL_M_REPORT\"","3":" \"status\": \"ENDED OK\"","4":" \"execution_time_in_seconds\": \"46.39\"","5":" \"Timestamp\": \"20240418 12:13:23\"","6":" }","7":" \"1\": {","8":" \"jobname\": \"DWHEAP_FW_AIMA_001\"","9":" \"status\": \"ENDED OK\"","10":" \"execution_time_in_seconds\": \"73.14\"","11":" \"Timestamp\": \"20240418 12:13:23\"","12":" }","13":" \"2\": {","14":" \"jobname\": \"DWHEAP_FW_BHW\"","15":" \"status\": \"ENDED OK\"","16":" \"execution_time_in_seconds\": \"71.19\"","17":" \"Timestamp\": \"20240418 12:13:23\"","18":" }","19":" \"3\": {","20":" \"jobname\": \"DWHEAP_FW_NODATA\"","21":" \"status\": \"ENDED OK\"","22":" \"execution_time_in_seconds\": \"80.63\"","23":" \"Timestamp\": \"20240418 12:13:23\"","24":" }","25":" \"4\": {","26":" \"jobname\": \"DWHEAP_FW_TALANX\"","27":" \"status\": \"ENDED OK\"","28":" \"execution_time_in_seconds\": \"80.20\"","29":" \"Timestamp\": \"20240418 12:13:23\"","30":" }","31":" \"5\": {","32":" \"jobname\": \"DWHEAP_FW_UC4_001\"","33":" \"status\": \"ENDED OK\"","34":" \"execution_time_in_seconds\": \"80.13\"","35":" \"Timestamp\": \"20240418 12:13:23\"","36":" }","37":" \"6\": {","38":" \"jobname\": \"DWHEAP_TALANX_LSP_FW_NODATA\"","39":" \"status\": \"ENDED NOTOK\"","40":" \"execution_time_in_seconds\": \"120.12\"","41":" \"Timestamp\": \"20240418 12:13:23\"","42":" }","43":" \"7\": {","44":" \"jobname\": \"RDV_INFRASTRUCTURE_DETAILS\"","45":" \"status\": \"ENDED OK\"","46":" \"execution_time_in_seconds\": \"81.16\"","47":" \"Timestamp\": \"20240418 12:13:23\"","48":" }","49":" \"8\": {","50":" \"jobname\": \"VIPASNEU_STG\"","51":" \"status\": \"ENDED OK\"","52":" \"execution_time_in_seconds\": \"45.04\"","53":" \"Timestamp\": \"20240418 12:13:23\"","54":" }","55":"}"}} Please look into this and kindly help us in extraction of the job which contains string NODATA from the above set of job names that has been extracted

Renunaren · ‎03-28-2024

Hi ITWhisperer, Thank you for your message. This has worked partially. But we are unable to get the full count of those jobs with State ENDED NOTOK. Please help me out on this.

Renunaren · ‎03-28-2024

Hello ITWhisperer, Thank you for your response. I have extracted all the mentioned fields earlier as well. But is there any possibility in extraction, so that we can only extract the status of ENDED NOTOK jobs only.

Renunaren · ‎03-28-2024

Hi Team, The below is the event which we have received into the splunk, Dataframe row : {"_c0":{"0":"{","1":" \"0\": {","2":" \"jobname\": \"A001_GVE_ADHOC_AUDIT\"","3":" \"status\": \"ENDED NOTOK\"","4":" \"Timestamp\": \"20240317 13:25:23\"","5":" }","6":" \"1\": {","7":" \"jobname\": \"BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TSYS\"","8":" \"status\": \"ENDED NOTOK\"","9":" \"Timestamp\": \"20240317 13:25:23\"","10":" }","11":" \"2\": {","12":" \"jobname\": \"BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TSYS_WEEKLY\"","13":" \"status\": \"ENDED NOTOK\"","14":" \"Timestamp\": \"20240317 13:25:23\"","15":" }","16":" \"3\": {","17":" \"jobname\": \"D001_GVE_SOFT_MATCHING_GDH_CA\"","18":" \"status\": \"ENDED NOTOK\"","19":" \"Timestamp\": \"20240317 13:25:23\"","20":" }","21":" \"4\": {","22":" \"jobname\": \"D100_AKS_CDWH_SQOOP_TRX_ORG\"","23":" \"status\": \"ENDED NOTOK\"","24":" \"Timestamp\": \"20240317 13:25:23\"","25":" }","26":" \"5\": {","27":" \"jobname\": \"D100_AKS_CDWH_SQOOP_TYP_123\"","28":" \"status\": \"ENDED NOTOK\"","29":" \"Timestamp\": \"20240317 13:25:23\"","30":" }","31":" \"6\": {","32":" \"jobname\": \"D100_AKS_CDWH_SQOOP_TYP_45\"","33":" \"status\": \"ENDED OK\"","34":" \"Timestamp\": \"20240317 13:25:23\"","35":" }","36":" \"7\": {","37":" \"jobname\": \"D100_AKS_CDWH_SQOOP_TYP_ENPW\"","38":" \"status\": \"ENDED NOTOK\"","39":" \"Timestamp\": \"20240317 13:25:23\"","40":" }","41":" \"8\": {","42":" \"jobname\": \"D100_AKS_CDWH_SQOOP_TYP_T\"","43":" \"status\": \"ENDED NOTOK\"","44":" \"Timestamp\": \"20240317 13:25:23\"","45":" }","46":" \"9\": {","47":" \"jobname\": \"DREAMPC_CALC_ML_NAMESAPCE\"","48":" \"status\": \"ENDED NOTOK\"","49":" \"Timestamp\": \"20240317 13:25:23\"","50":" }","51":" \"10\": {","52":" \"jobname\": \"DREAMPC_MEMORY_AlERT_SIT\"","53":" \"status\": \"ENDED NOTOK\"","54":" \"Timestamp\": \"20240317 13:25:23\"","55":" }","56":" \"11\": {","57":" \"jobname\": \"DREAM_BDV_NBR_PRE_REQUISITE_TLX_LSP_3RD_PARTY_TRNS\"","58":" \"status\": \"ENDED NOTOK\"","59":" \"Timestamp\": \"20240317 13:25:23\"","60":" }","61":" \"12\": {","62":" \"jobname\": \"DREAM_BDV_NBR_PRE_REQUISITE_TLX_LSP_3RD_PARTY_TRNS_WEEKLY\"","63":" \"status\": \"ENDED NOTOK\"","64":" \"Timestamp\": \"20240317 13:25:23\"","65":" }","66":" \"13\": {","67":" \"jobname\": \"DREAM_BDV_NBR_STG_TLX_LSP_3RD_PARTY_TRNS\"","68":" \"status\": \"ENDED OK\"","69":" \"Timestamp\": \"20240317 13:25:23\"","70":" }","71":" \"14\": {","72":" \"jobname\": \"DREAM_BDV_NBR_STG_TLX_LSP_3RD_PARTY_TRNS_WEEKLY\"","73":" \"status\": \"ENDED OK\"","74":" \"Timestamp\": \"20240317 13:25:23\"","75":" }","76":" \"15\": {","77":" \"jobname\": \"DREAM_BDV_NBR_TLX_LSP_3RD_PARTY_TRNS\"","78":" \"status\": \"ENDED OK\"","79":" \"Timestamp\": \"20240317 13:25:23\"","80":" }","81":" \"16\": {","82":" \"jobname\": \"DREAM_BDV_NBR_TLX_LSP_3RD_PARTY_TRNS_WEEKLY\"","83":" \"status\": \"ENDED OK\"","84":" \"Timestamp\": \"20240317 13:25:23\"","85":" }","86":" \"17\": {","87":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_GDH\"","88":" \"status\": \"ENDED OK\"","89":" \"Timestamp\": \"20240317 13:25:23\"","90":" }","91":" \"18\": {","92":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_GDH_WEEKLY\"","93":" \"status\": \"ENDED OK\"","94":" \"Timestamp\": \"20240317 13:25:23\"","95":" }","96":" \"19\": {","97":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_SAMCONTDEPOT\"","98":" \"status\": \"ENDED NOTOK\"","99":" \"Timestamp\": \"20240317 13:25:23\"","100":" }","101":" \"20\": {","102":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TLXLSP_TRXN\"","103":" \"status\": \"ENDED NOTOK\"","104":" \"Timestamp\": \"20240317 13:25:23\"","105":" }","106":" \"21\": {","107":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TRADEABR\"","108":" \"status\": \"ENDED OK\"","109":" \"Timestamp\": \"20240317 13:25:23\"","110":" }","111":" \"22\": {","112":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TRADEABR_WEEKLY\"","113":" \"status\": \"ENDED OK\"","114":" \"Timestamp\": \"20240317 13:25:23\"","115":" }","116":" \"23\": {","117":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TRADESON\"","118":" \"status\": \"ENDED NOTOK\"","119":" \"Timestamp\": \"20240317 13:25:23\"","120":" }","121":" \"24\": {","122":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TRADESON_WEEKLY\"","123":" \"status\": \"ENDED OK\"","124":" \"Timestamp\": \"20240317 13:25:23\"","125":" }","126":" \"25\": {","127":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_ZCI\"","128":" \"status\": \"ENDED NOTOK\"","129":" \"Timestamp\": \"20240317 13:25:23\"","130":" }","131":" \"26\": {","132":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_ZCI_WEEKLY\"","133":" \"status\": \"ENDED NOTOK\"","134":" \"Timestamp\": \"20240317 13:25:23\"","135":" }" we have tried to extract the required fields such as Timestamp, Jobname, Status from the above events using the below splunk query index=app_events_dwh2_de_int _raw=*jobname* | rex max_match=0 "\\\\\\\\\\\\\"jobname\\\\\\\\\\\\\":\s*\\\\\\\\\\\\\"(?<Name>[^\\\]+)" | rex max_match=0 "\\\\\\\\\\\\\"status\\\\\\\\\\\\\":\s*\\\\\\\\\\\\\"(?<State>[^\\\]+)" | rex max_match=0 "Timestamp\\\\\\\\\\\\\": \\\\\\\\\\\\\"(?<TIME>\d+\s*\d+\:\d+\:\d+)" | rex max_match=0 "execution_time_in_seconds\\\\\\\\\\\\\": \\\\\\\\\\\\\"(?<EXECUTION_TIME>[\d\.\-]+)" | table "TIME", "Name", "State", "EXECUTION_TIME" | mvexpand TIME But the issue we want to extract only those status jobs with status as " ENDED NOTOK". But we are unable to extract them. Also when we use mvexpand command for the table, it is showing multiple duplicate values. We request you to kindly look into this and help us on this issue.

Renunaren · ‎03-28-2024

Hi Team, The above is the event which we have received into the splunk. We have tried to extract the fields such as Timestamp, Jobname, Status using the below query index=app_events_dwh2_de_int _raw=*jobname* | rex max_match=0 "\\\\\\\\\\\\\"jobname\\\\\\\\\\\\\":\s*\\\\\\\\\\\\\"(?<Name>[^\\\]+)" | rex max_match=0 "\\\\\\\\\\\\\"status\\\\\\\\\\\\\":\s*\\\\\\\\\\\\\"(?<State>[^\\\]+)" | rex max_match=0 "Timestamp\\\\\\\\\\\\\": [file://%22(%3f%3cTIME%3e/d+/s*/d+/:/d+/:/d+)]\\\\\\\\\\\\\"(?<TIME>\d+\s*\d+\:\d+\:\d+)" | rex max_match=0 "execution_time_in_seconds\\\\\\\\\\\\\": [file://%22(%3f%3cEXECUTION_TIME%3e[/d/-%5d+)]\\\\\\\\\\\\\"(?<EXECUTION_TIME>[\d\.\-]+)" | table "TIME", "Name", "State", "EXECUTION_TIME" | mvexpand TIME But the issue we want to extract only those status jobs with status as " ENDED NOTOK". But we are unable to extract them. Also when we use mvexpand command for the table, it is showing multiple duplicate values. We request you to kindly look into this and help us on this issue.

Renunaren · ‎03-28-2024

Dataframe row : {"_c0":{"0":"{","1":" \"0\": {","2":" \"jobname\": \"A001_GVE_ADHOC_AUDIT\"","3":" \"status\": \"ENDED NOTOK\"","4":" \"Timestamp\": \"20240317 13:25:23\"","5":" }","6":" \"1\": {","7":" \"jobname\": \"BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TSYS\"","8":" \"status\": \"ENDED NOTOK\"","9":" \"Timestamp\": \"20240317 13:25:23\"","10":" }","11":" \"2\": {","12":" \"jobname\": \"BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TSYS_WEEKLY\"","13":" \"status\": \"ENDED NOTOK\"","14":" \"Timestamp\": \"20240317 13:25:23\"","15":" }","16":" \"3\": {","17":" \"jobname\": \"D001_GVE_SOFT_MATCHING_GDH_CA\"","18":" \"status\": \"ENDED NOTOK\"","19":" \"Timestamp\": \"20240317 13:25:23\"","20":" }","21":" \"4\": {","22":" \"jobname\": \"D100_AKS_CDWH_SQOOP_TRX_ORG\"","23":" \"status\": \"ENDED NOTOK\"","24":" \"Timestamp\": \"20240317 13:25:23\"","25":" }","26":" \"5\": {","27":" \"jobname\": \"D100_AKS_CDWH_SQOOP_TYP_123\"","28":" \"status\": \"ENDED NOTOK\"","29":" \"Timestamp\": \"20240317 13:25:23\"","30":" }","31":" \"6\": {","32":" \"jobname\": \"D100_AKS_CDWH_SQOOP_TYP_45\"","33":" \"status\": \"ENDED OK\"","34":" \"Timestamp\": \"20240317 13:25:23\"","35":" }","36":" \"7\": {","37":" \"jobname\": \"D100_AKS_CDWH_SQOOP_TYP_ENPW\"","38":" \"status\": \"ENDED NOTOK\"","39":" \"Timestamp\": \"20240317 13:25:23\"","40":" }","41":" \"8\": {","42":" \"jobname\": \"D100_AKS_CDWH_SQOOP_TYP_T\"","43":" \"status\": \"ENDED NOTOK\"","44":" \"Timestamp\": \"20240317 13:25:23\"","45":" }","46":" \"9\": {","47":" \"jobname\": \"DREAMPC_CALC_ML_NAMESAPCE\"","48":" \"status\": \"ENDED NOTOK\"","49":" \"Timestamp\": \"20240317 13:25:23\"","50":" }","51":" \"10\": {","52":" \"jobname\": \"DREAMPC_MEMORY_AlERT_SIT\"","53":" \"status\": \"ENDED NOTOK\"","54":" \"Timestamp\": \"20240317 13:25:23\"","55":" }","56":" \"11\": {","57":" \"jobname\": \"DREAM_BDV_NBR_PRE_REQUISITE_TLX_LSP_3RD_PARTY_TRNS\"","58":" \"status\": \"ENDED NOTOK\"","59":" \"Timestamp\": \"20240317 13:25:23\"","60":" }","61":" \"12\": {","62":" \"jobname\": \"DREAM_BDV_NBR_PRE_REQUISITE_TLX_LSP_3RD_PARTY_TRNS_WEEKLY\"","63":" \"status\": \"ENDED NOTOK\"","64":" \"Timestamp\": \"20240317 13:25:23\"","65":" }","66":" \"13\": {","67":" \"jobname\": \"DREAM_BDV_NBR_STG_TLX_LSP_3RD_PARTY_TRNS\"","68":" \"status\": \"ENDED OK\"","69":" \"Timestamp\": \"20240317 13:25:23\"","70":" }","71":" \"14\": {","72":" \"jobname\": \"DREAM_BDV_NBR_STG_TLX_LSP_3RD_PARTY_TRNS_WEEKLY\"","73":" \"status\": \"ENDED OK\"","74":" \"Timestamp\": \"20240317 13:25:23\"","75":" }","76":" \"15\": {","77":" \"jobname\": \"DREAM_BDV_NBR_TLX_LSP_3RD_PARTY_TRNS\"","78":" \"status\": \"ENDED OK\"","79":" \"Timestamp\": \"20240317 13:25:23\"","80":" }","81":" \"16\": {","82":" \"jobname\": \"DREAM_BDV_NBR_TLX_LSP_3RD_PARTY_TRNS_WEEKLY\"","83":" \"status\": \"ENDED OK\"","84":" \"Timestamp\": \"20240317 13:25:23\"","85":" }","86":" \"17\": {","87":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_GDH\"","88":" \"status\": \"ENDED OK\"","89":" \"Timestamp\": \"20240317 13:25:23\"","90":" }","91":" \"18\": {","92":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_GDH_WEEKLY\"","93":" \"status\": \"ENDED OK\"","94":" \"Timestamp\": \"20240317 13:25:23\"","95":" }","96":" \"19\": {","97":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_SAMCONTDEPOT\"","98":" \"status\": \"ENDED NOTOK\"","99":" \"Timestamp\": \"20240317 13:25:23\"","100":" }","101":" \"20\": {","102":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TLXLSP_TRXN\"","103":" \"status\": \"ENDED NOTOK\"","104":" \"Timestamp\": \"20240317 13:25:23\"","105":" }","106":" \"21\": {","107":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TRADEABR\"","108":" \"status\": \"ENDED OK\"","109":" \"Timestamp\": \"20240317 13:25:23\"","110":" }","111":" \"22\": {","112":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TRADEABR_WEEKLY\"","113":" \"status\": \"ENDED OK\"","114":" \"Timestamp\": \"20240317 13:25:23\"","115":" }","116":" \"23\": {","117":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TRADESON\"","118":" \"status\": \"ENDED NOTOK\"","119":" \"Timestamp\": \"20240317 13:25:23\"","120":" }","121":" \"24\": {","122":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TRADESON_WEEKLY\"","123":" \"status\": \"ENDED OK\"","124":" \"Timestamp\": \"20240317 13:25:23\"","125":" }","126":" \"25\": {","127":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_ZCI\"","128":" \"status\": \"ENDED NOTOK\"","129":" \"Timestamp\": \"20240317 13:25:23\"","130":" }","131":" \"26\": {","132":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_ZCI_WEEKLY\"","133":" \"status\": \"ENDED NOTOK\"","134":" \"Timestamp\": \"20240317 13:25:23\"","135":" }"

Renunaren · ‎03-06-2024

Hi Thanks for your response and this has worked in field extraction.

Renunaren · ‎03-05-2024

Hi Gcusello, Thanks for your response, I have tried to extract the required value as per the suggestion given by you but I am unable to extract the required value. Below is the raw message of the given event. I request you to look into the below and help me out in extracting the value. {"timestamp": "2024-03-01T07:36:54.276974Z", "level": "INFO", "filename": "splunk_sample_csv.py", "funcName": "main", "lineno": 43, "message": "Dataframe row : {\"_c0\":{\"0\":\"{\",\"1\":\" \\\"0\\\": {\",\"2\":\" \\\"jobname\\\": \\\"A001_GVE_ADHOC_AUDIT\\\"\",\"3\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"4\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"5\":\" }\",\"6\":\" \\\"1\\\": {\",\"7\":\" \\\"jobname\\\": \\\"BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TSYS\\\"\",\"8\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"9\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"10\":\" }\",\"11\":\" \\\"2\\\": {\",\"12\":\" \\\"jobname\\\": \\\"BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TSYS_WEEKLY\\\"\",\"13\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"14\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"15\":\" }\",\"16\":\" \\\"3\\\": {\",\"17\":\" \\\"jobname\\\": \\\"D001_GVE_SOFT_MATCHING_GDH_CA\\\"\",\"18\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"19\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"20\":\" }\",\"21\":\" \\\"4\\\": {\",\"22\":\" \\\"jobname\\\": \\\"D100_AKS_CDWH_SQOOP_TRX_ORG\\\"\",\"23\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"24\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"25\":\" }\",\"26\":\" \\\"5\\\": {\",\"27\":\" \\\"jobname\\\": \\\"D100_AKS_CDWH_SQOOP_TYP_123\\\"\",\"28\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"29\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"30\":\" }\",\"31\":\" \\\"6\\\": {\",\"32\":\" \\\"jobname\\\": \\\"D100_AKS_CDWH_SQOOP_TYP_45\\\"\",\"33\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"34\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"35\":\" }\",\"36\":\" \\\"7\\\": {\",\"37\":\" \\\"jobname\\\": \\\"D100_AKS_CDWH_SQOOP_TYP_ENPW\\\"\",\"38\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"39\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"40\":\" }\",\"41\":\" \\\"8\\\": {\",\"42\":\" \\\"jobname\\\": \\\"D100_AKS_CDWH_SQOOP_TYP_T\\\"\",\"43\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"44\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"45\":\" }\",\"46\":\" \\\"9\\\": {\",\"47\":\" \\\"jobname\\\": \\\"DREAMPC_CALC_ML_NAMESAPCE\\\"\",\"48\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"49\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"50\":\" }\",\"51\":\" \\\"10\\\": {\",\"52\":\" \\\"jobname\\\": \\\"DREAMPC_MEMORY_AlERT_SIT\\\"\",\"53\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"54\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"55\":\" }\",\"56\":\" \\\"11\\\": {\",\"57\":\" \\\"jobname\\\": \\\"DREAM_BDV_NBR_PRE_REQUISITE_TLX_LSP_3RD_PARTY_TRNS\\\"\",\"58\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"59\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"60\":\" }\",\"61\":\" \\\"12\\\": {\",\"62\":\" \\\"jobname\\\": \\\"DREAM_BDV_NBR_PRE_REQUISITE_TLX_LSP_3RD_PARTY_TRNS_WEEKLY\\\"\",\"63\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"64\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"65\":\" }\",\"66\":\" \\\"13\\\": {\",\"67\":\" \\\"jobname\\\": \\\"DREAM_BDV_NBR_STG_TLX_LSP_3RD_PARTY_TRNS\\\"\",\"68\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"69\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"70\":\" }\",\"71\":\" \\\"14\\\": {\",\"72\":\" \\\"jobname\\\": \\\"DREAM_BDV_NBR_STG_TLX_LSP_3RD_PARTY_TRNS_WEEKLY\\\"\",\"73\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"74\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"75\":\" }\",\"76\":\" \\\"15\\\": {\",\"77\":\" \\\"jobname\\\": \\\"DREAM_BDV_NBR_TLX_LSP_3RD_PARTY_TRNS\\\"\",\"78\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"79\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"80\":\" }\",\"81\":\" \\\"16\\\": {\",\"82\":\" \\\"jobname\\\": \\\"DREAM_BDV_NBR_TLX_LSP_3RD_PARTY_TRNS_WEEKLY\\\"\",\"83\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"84\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"85\":\" }\",\"86\":\" \\\"17\\\": {\",\"87\":\" \\\"jobname\\\": \\\"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_GDH\\\"\",\"88\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"89\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"90\":\" }\",\"91\":\" \\\"18\\\": {\",\"92\":\" \\\"jobname\\\": \\\"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_GDH_WEEKLY\\\"\",\"93\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"94\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"95\":\" }\",\"96\":\" \\\"19\\\": {\",\"97\":\" \\\"jobname\\\": \\\"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_SAMCONTDEPOT\\\"\",\"98\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"99\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"100\":\" }\",\"101\":\" \\\"20\\\": {\",\"102\":\" \\\"jobname\\\": \\\"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TLXLSP_TRXN\\\"\",\"103\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"104\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"105\":\" }\",\"106\":\" \\\"21\\\": {\",\"107\":\" \\\"jobname\\\": \\\"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TRADEABR\\\"\",\"108\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"109\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"110\":\" }\",\"111\":\" \\\"22\\\": {\",\"112\":\" \\\"jobname\\\": \\\"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TRADEABR_WEEKLY\\\"\",\"113\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"114\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"115\":\" }\",\"116\":\" \\\"23\\\": {\",\"117\":\" \\\"jobname\\\": \\\"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TRADESON\\\"\",\"118\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"119\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"120\":\" }\",\"121\":\" \\\"24\\\": {\",\"122\":\" \\\"jobname\\\": \\\"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TRADESON_WEEKLY\\\"\",\"123\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"124\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"125\":\" }\",\"126\":\" \\\"25\\\": {\",\"127\":\" \\\"jobname\\\": \\\"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_ZCI\\\"\",\"128\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"129\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"130\":\" }\",\"131\":\" \\\"26\\\": {\",\"132\":\" \\\"jobname\\\": \\\"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_ZCI_WEEKLY\\\"\",\"133\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"134\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"135\":\" }\",\"136\":\" \\\"27\\\": {\",\"137\":\" \\\"jobname\\\": \\\"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_ZPI\\\"\",\"138\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"139\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"140\":\" }\",\"141\":\" \\\"28\\\": {\",\"142\":\" \\\"jobname\\\": \\\"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_ZPI_WEEKLY\\\"\",\"143\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"144\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"145\":\" }\",\"146\":\" \\\"29\\\": {\",\"147\":\" \\\"jobname\\\": \\\"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQ_SAMCONTDEPOT_WEEKLY\\\"\",\"148\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"149\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"150\":\" }\",\"151\":\" \\\"30\\\": {\",\"152\":\" \\\"jobname\\\": \\\"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQ_TALANX_TRAN\\\"\",\"153\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"154\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"155\":\" }\",\"156\":\" \\\"31\\\": {\",\"157\":\" \\\"jobname\\\": \\\"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQ_TALANX_TRAN_WEEKLY\\\"\",\"158\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"159\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"160\":\" }\",\"161\":\" \\\"32\\\": {\",\"162\":\" \\\"jobname\\\": \\\"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQ_TLXLSP_TRXN_WEEKLY\\\"\",\"163\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"164\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"165\":\" }\",\"166\":\" \\\"33\\\": {\",\"167\":\" \\\"jobname\\\": \\\"DREAM_BDV_NEW_BUSINESS_REPORTING_STG_TRADEABR\\\"\",\"168\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"169\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"170\":\" }\",\"171\":\" \\\"34\\\": {\",\"172\":\" \\\"jobname\\\": \\\"DREAM_BUILD_GDH_MIS_BDV_01\\\"\",\"173\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"174\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"175\":\" }\",\"176\":\" \\\"35\\\": {\",\"177\":\" \\\"jobname\\\": \\\"DREAM_BUILD_GDH_MIS_BDV_02\\\"\",\"178\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"179\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"180\":\" }\",\"181\":\" \\\"36\\\": {\",\"182\":\" \\\"jobname\\\": \\\"DREAM_BUILD_GDH_MIS_BDV_03\\\"\",\"183\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"184\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"185\":\" }\",\"186\":\" \\\"37\\\": {\",\"187\":\" \\\"jobname\\\": \\\"DREAM_BUILD_GDH_MIS_BDV_04\\\"\",\"188\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"189\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"190\":\" }\",\"191\":\" \\\"38\\\": {\",\"192\":\" \\\"jobname\\\": \\\"DREAM_BUILD_GDH_MIS_BDV_LINK\\\"\",\"193\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"194\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"195\":\" }\",\"196\":\" \\\"39\\\": {\",\"197\":\" \\\"jobname\\\": \\\"DREAM_BUILD_GDH_MIS_BDV_UNION\\\"\",\"198\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"199\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"200\":\" }\",\"201\":\" \\\"40\\\": {\",\"202\":\" \\\"jobname\\\": \\\"DREAM_CALC_BDV_CONTROL_COPY\\\"\",\"203\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"204\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"205\":\" }\",\"206\":\" \\\"41\\\": {\",\"207\":\" \\\"jobname\\\": \\\"DREAM_CDWH_TLX_LSP_3RD_PARTY_TRNS_FACT_OUTBOUND_WEEKLY\\\"\",\"208\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"209\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"210\":\" }\",\"211\":\" \\\"42\\\": {\",\"212\":\" \\\"jobname\\\": \\\"DREAM_FILE_DELETION_OUTBOUND\\\"\",\"213\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"214\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"215\":\" }\",\"216\":\" \\\"43\\\": {\",\"217\":\" \\\"jobname\\\": \\\"DREAM_FVDB_TLX_LSP_3RD_PARTY_TRNS_FACT_OUTBOUND_WEEKLY\\\"\",\"218\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"219\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"220\":\" }\",\"221\":\" \\\"44\\\": {\",\"222\":\" \\\"jobname\\\": \\\"DREAM_FVDB_TOCSV_TLX_LSP_3RD_PARTY_TRNS_FACT_OUTBOUND_WEEKLY\\\"\",\"223\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"224\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"225\":\" }\",\"226\":\" \\\"45\\\": {\",\"227\":\" \\\"jobname\\\": \\\"DREAM_GVE_GDH_NEW_BUSINESS_FACT_OUTBOUND\\\"\",\"228\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"229\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"230\":\" }\",\"231\":\" \\\"46\\\": {\",\"232\":\" \\\"jobname\\\": \\\"DREAM_GVE_TLX_LSP_3RD_PARTY_TRNS_FACT_OUTBOUND_WEEKLY\\\"\",\"233\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"234\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"235\":\" }\",\"236\":\" \\\"47\\\": {\",\"237\":\" \\\"jobname\\\": \\\"DREAM_MEMORY_ALERT_SIT\\\"\",\"238\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"239\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"240\":\" }\",\"241\":\" \\\"48\\\": {\",\"242\":\" \\\"jobname\\\": \\\"DREAM_MIS_BDV_GMOMIS46_GDH_CORRECTION\\\"\",\"243\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"244\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"245\":\" }\",\"246\":\" \\\"49\\\": {\",\"247\":\" \\\"jobname\\\": \\\"DREAM_MIS_BDV_TALANXLSP_INVENTORY_THIRD_PARTY_PRE_REQUISITE\\\"\",\"248\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"249\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"250\":\" }\",\"251\":\" \\\"50\\\": {\",\"252\":\" \\\"jobname\\\": \\\"DREAM_MIS_BDV_TALANX_INSURANCE_PRE_REQUISITE\\\"\",\"253\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"254\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"255\":\" }\",\"256\":\" \\\"51\\\": {\",\"257\":\" \\\"jobname\\\": \\\"DREAM_MIS_BDV_TALANX_INSURANCE_WEEKLY_PRE_REQUISITE\\\"\",\"258\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"259\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"260\":\" }\",\"261\":\" \\\"52\\\": {\",\"262\":\" \\\"jobname\\\": \\\"DREAM_MIS_BDV_TALANX_LSP3P_INV\\\"\",\"263\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"264\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"265\":\" }\",\"266\":\" \\\"53\\\": {\",\"267\":\" \\\"jobname\\\": \\\"DREAM_MIS_BDV_TALANX_LSP3P_TRANSACTION\\\"\",\"268\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"269\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"270\":\" }\",\"271\":\" \\\"54\\\": {\",\"272\":\" \\\"jobname\\\": \\\"DREAM_MIS_BDV_TSYS_STOCK_PRE_REQUISITE\\\"\",\"273\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"274\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"275\":\" }\",\"276\":\" \\\"55\\\": {\",\"277\":\" \\\"jobname\\\": \\\"DREAM_MIS_BDV_TSYS_STOCK_PRE_REQUISITE_WEEKLY\\\"\",\"278\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"279\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"280\":\" }\",\"281\":\" \\\"56\\\": {\",\"282\":\" \\\"jobname\\\": \\\"DREAM_MIS_PRECHECK_TALANXLSPDB_INVENTORY\\\"\",\"283\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"284\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"285\":\" }\",\"286\":\" \\\"57\\\": {\",\"287\":\" \\\"jobname\\\": \\\"DREAM_MIS_PRECHECK_ZCI_INVENTORY_MONTHLY\\\"\",\"288\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"289\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"290\":\" }\",\"291\":\" \\\"58\\\": {\",\"292\":\" \\\"jobname\\\": \\\"DREAM_MIS_PRECHECK_ZCI_TRANSACTION_MONTHLY\\\"\",\"293\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"294\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"295\":\" }\",\"296\":\" \\\"59\\\": {\",\"297\":\" \\\"jobname\\\": \\\"DREAM_MIS_PRECHECK_ZPI_INVENTORY_MONTHLY\\\"\",\"298\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"299\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"300\":\" }\",\"301\":\" \\\"60\\\": {\",\"302\":\" \\\"jobname\\\": \\\"DREAM_MIS_PRECHECK_ZPI_TRANSACTION_MONTHLY\\\"\",\"303\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"304\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"305\":\" }\",\"306\":\" \\\"61\\\": {\",\"307\":\" \\\"jobname\\\": \\\"DREAM_MIS_VP_FACTOR_PRE_PROCESSING\\\"\",\"308\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"309\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"310\":\" }\",\"311\":\" \\\"62\\\": {\",\"312\":\" \\\"jobname\\\": \\\"DREAM_NEW_BUSINESS_DETECTION_TLX_LSP3P_TRANSACTION\\\"\",\"313\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"314\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"315\":\" }\",\"316\":\" \\\"63\\\": {\",\"317\":\" \\\"jobname\\\": \\\"DREAM_PRECHECK_GDH_DAILY_DATA\\\"\",\"318\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"319\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"320\":\" }\",\"321\":\" \\\"64\\\": {\",\"322\":\" \\\"jobname\\\": \\\"DREAM_PRECHECK_TLX_DAILY_DATA_LSP3P_INV\\\"\",\"323\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"324\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"325\":\" }\",\"326\":\" \\\"65\\\": {\",\"327\":\" \\\"jobname\\\": \\\"DREAM_PRECHECK_TLX_DAILY_DATA_LSP3P_TRANSACTION\\\"\",\"328\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"329\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"330\":\" }\",\"331\":\" \\\"66\\\": {\",\"332\":\" \\\"jobname\\\": \\\"DREAM_PRECHECK_TLX_LSP3P_TRANSACTION_DAILY\\\"\",\"333\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"334\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"335\":\" }\",\"336\":\" \\\"67\\\": {\",\"337\":\" \\\"jobname\\\": \\\"DREAM_RDL_GDH_NEW_BUSINESS_FACT\\\"\",\"338\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"339\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"340\":\" }\",\"341\":\" \\\"68\\\": {\",\"342\":\" \\\"jobname\\\": \\\"DREAM_RDL_STG_GDH_NEW_BUSINESS_FACT\\\"\",\"343\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"344\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"345\":\" }\",\"346\":\" \\\"69\\\": {\",\"347\":\" \\\"jobname\\\": \\\"DREAM_RDL_STG_TLX_LSP_3RD_PARTY_TRNS_FACT\\\"\",\"348\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"349\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"350\":\" }\",\"351\":\" \\\"70\\\": {\",\"352\":\" \\\"jobname\\\": \\\"DREAM_RDL_STG_TLX_LSP_3RD_PARTY_TRNS_FACT_WEEKLY\\\"\",\"353\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"354\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"355\":\" }\",\"356\":\" \\\"71\\\": {\",\"357\":\" \\\"jobname\\\": \\\"DREAM_RDL_TLX_LSP_3RD_PARTY_TRNS_FACT\\\"\",\"358\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"359\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"360\":\" }\",\"361\":\" \\\"72\\\": {\",\"362\":\" \\\"jobname\\\": \\\"DREAM_RDL_TLX_LSP_3RD_PARTY_TRNS_FACT_WEEKLY\\\"\",\"363\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"364\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"365\":\" }\",\"366\":\" \\\"73\\\": {\",\"367\":\" \\\"jobname\\\": \\\"DREAM_REDUCE_FILE_SIZE\\\"\",\"368\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"369\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"370\":\" }\",\"371\":\" \\\"74\\\": {\",\"372\":\" \\\"jobname\\\": \\\"DREAM_SDM_STG_GMARS_FDWRISK_FACT\\\"\",\"373\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"374\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"375\":\" }\",\"376\":\" \\\"75\\\": {\",\"377\":\" \\\"jobname\\\": \\\"DREAM_SDM_STG_TLX_LSP_3RD_PARTY_TRNS_FACT_WEEKLY\\\"\",\"378\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"379\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"380\":\" }\",\"381\":\" \\\"76\\\": {\",\"382\":\" \\\"jobname\\\": \\\"DREAM_TDM_STG_TALANXLSP_TRANSACTION_THIRD_PARTY_NB_FACT_WEEKLY\\\"\",\"383\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"384\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"385\":\" }\",\"386\":\" \\\"77\\\": {\",\"387\":\" \\\"jobname\\\": \\\"M002_GVE_SALES_KEY_MATCH_MAP_GVE_TO_DC\\\"\",\"388\":\" \\\"status\\\": \\\"ENDED OK\\\"\",\"389\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"390\":\" }\",\"391\":\" \\\"78\\\": {\",\"392\":\" \\\"jobname\\\": \\\"M003_GVE_AKS_PAYMNET_TRANSACTION_LOAD\\\"\",\"393\":\" \\\"status\\\": \\\"ENDED NOTOK\\\"\",\"394\":\" \\\"Timestamp\\\": \\\"20240301\\\"\",\"395\":\" }\",\"396\":\"}\"}} ", "process": 22969, "processName": "MainProcess"}

Renunaren · ‎03-05-2024

Hi Team, I am unable to extract the Timestamp value from the below message in splunk events using rex command and add that value to new field. I request you to kindly look into this and help me out in extracting that value to the new field by name TIME. Below is the event message. The Timestamp value is 20240301. We have to extract the similar values and add those value to the field TIME Dataframe row : {"_c0":{"0":"{","1":" \"0\": {","2":" \"jobname\": \"A001_GVE_ADHOC_AUDIT\"","3":" \"status\": \"ENDED NOTOK\"","4":" \"Timestamp\": \"20240301\"","5":" }","6":" \"1\": {","7":" \"jobname\": \"BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TSYS\"","8":" \"status\": \"ENDED NOTOK\"","9":" \"Timestamp\": \"20240301\"","10":" }","11":" \"2\": {","12":" \"jobname\": \"BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TSYS_WEEKLY\"","13":" \"status\": \"ENDED NOTOK\"","14":" \"Timestamp\": \"20240301\"","15":" }","16":" \"3\": {","17":" \"jobname\": \"D001_GVE_SOFT_MATCHING_GDH_CA\"","18":" \"status\": \"ENDED NOTOK\"","19":" \"Timestamp\": \"20240301\"","20":" }","21":" \"4\": {","22":" \"jobname\": \"D100_AKS_CDWH_SQOOP_TRX_ORG\"","23":" \"status\": \"ENDED NOTOK\"","24":" \"Timestamp\": \"20240301\"","25":" }","26":" \"5\": {","27":" \"jobname\": \"D100_AKS_CDWH_SQOOP_TYP_123\"","28":" \"status\": \"ENDED NOTOK\"","29":" \"Timestamp\": \"20240301\"","30":" }","31":" \"6\": {","32":" \"jobname\": \"D100_AKS_CDWH_SQOOP_TYP_45\"","33":" \"status\": \"ENDED OK\"","34":" \"Timestamp\": \"20240301\"","35":" }","36":" \"7\": {","37":" \"jobname\": \"D100_AKS_CDWH_SQOOP_TYP_ENPW\"","38":" \"status\": \"ENDED NOTOK\"","39":" \"Timestamp\": \"20240301\"","40":" }","41":" \"8\": {","42":" \"jobname\": \"D100_AKS_CDWH_SQOOP_TYP_T\"","43":" \"status\": \"ENDED NOTOK\"","44":" \"Timestamp\": \"20240301\"","45":" }","46":" \"9\": {","47":" \"jobname\": \"DREAMPC_CALC_ML_NAMESAPCE\"","48":" \"status\": \"ENDED NOTOK\"","49":" \"Timestamp\": \"20240301\"","50":" }","51":" \"10\": {","52":" \"jobname\": \"DREAMPC_MEMORY_AlERT_SIT\"","53":" \"status\": \"ENDED NOTOK\"","54":" \"Timestamp\": \"20240301\"","55":" }","56":" \"11\": {","57":" \"jobname\": \"DREAM_BDV_NBR_PRE_REQUISITE_TLX_LSP_3RD_PARTY_TRNS\"","58":" \"status\": \"ENDED NOTOK\"","59":" \"Timestamp\": \"20240301\"","60":" }","61":" \"12\": {","62":" \"jobname\": \"DREAM_BDV_NBR_PRE_REQUISITE_TLX_LSP_3RD_PARTY_TRNS_WEEKLY\"","63":" \"status\": \"ENDED NOTOK\"","64":" \"Timestamp\": \"20240301\"","65":" }","66":" \"13\": {","67":" \"jobname\": \"DREAM_BDV_NBR_STG_TLX_LSP_3RD_PARTY_TRNS\"","68":" \"status\": \"ENDED OK\"","69":" \"Timestamp\": \"20240301\"","70":" }","71":" \"14\": {","72":" \"jobname\": \"DREAM_BDV_NBR_STG_TLX_LSP_3RD_PARTY_TRNS_WEEKLY\"","73":" \"status\": \"ENDED OK\"","74":" \"Timestamp\": \"20240301\"","75":" }","76":" \"15\": {","77":" \"jobname\": \"DREAM_BDV_NBR_TLX_LSP_3RD_PARTY_TRNS\"","78":" \"status\": \"ENDED OK\"","79":" \"Timestamp\": \"20240301\"","80":" }","81":" \"16\": {","82":" \"jobname\": \"DREAM_BDV_NBR_TLX_LSP_3RD_PARTY_TRNS_WEEKLY\"","83":" \"status\": \"ENDED OK\"","84":" \"Timestamp\": \"20240301\"","85":" }","86":" \"17\": {","87":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_GDH\"","88":" \"status\": \"ENDED OK\"","89":" \"Timestamp\": \"20240301\"","90":" }","91":" \"18\": {","92":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_GDH_WEEKLY\"","93":" \"status\": \"ENDED OK\"","94":" \"Timestamp\": \"20240301\"","95":" }","96":" \"19\": {","97":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_SAMCONTDEPOT\"","98":" \"status\": \"ENDED NOTOK\"","99":" \"Timestamp\": \"20240301\"","100":" }","101":" \"20\": {","102":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TLXLSP_TRXN\"","103":" \"status\": \"ENDED NOTOK\"","104":" \"Timestamp\": \"20240301\"","105":" }","106":" \"21\": {","107":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TRADEABR\"","108":" \"status\": \"ENDED OK\"","109":" \"Timestamp\": \"20240301\"","110":" }","111":" \"22\": {","112":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TRADEABR_WEEKLY\"","113":" \"status\": \"ENDED OK\"","114":" \"Timestamp\": \"20240301\"","115":" }","116":" \"23\": {","117":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TRADESON\"","118":" \"status\": \"ENDED NOTOK\"","119":" \"Timestamp\": \"20240301\"","120":" }","121":" \"24\": {","122":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TRADESON_WEEKLY\"","123":" \"status\": \"ENDED OK\"","124":" \"Timestamp\": \"20240301\"","125":" }","126":" \"25\": {","127":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_ZCI\"","128":" \"status\": \"ENDED NOTOK\"","129":" \"Timestamp\": \"20240301\"","130":" }","131":" \"26\": {","132":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_ZCI_WEEKLY\"","133":" \"status\": \"ENDED NOTOK\"","134":" \"Timestamp\": \"20240301\"","135":" }","136":" \"27\": {","137":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_ZPI\"","138":" \"status\": \"ENDED NOTOK\"","139":" \"Timestamp\": \"20240301\"","140":" }","141":" \"28\": {","142":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_ZPI_WEEKLY\"","143":" \"status\": \"ENDED NOTOK\"","144":" \"Timestamp\": \"20240301\"","145":" }","146":" \"29\": {","147":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQ_SAMCONTDEPOT_WEEKLY\"","148":" \"status\": \"ENDED NOTOK\"","149":" \"Timestamp\": \"20240301\"","150":" }","151":" \"30\": {","152":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQ_TALANX_TRAN\"","153":" \"status\": \"ENDED NOTOK\"","154":" \"Timestamp\": \"20240301\"","155":" }","156":" \"31\": {","157":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQ_TALANX_TRAN_WEEKLY\"","158":" \"status\": \"ENDED NOTOK\"","159":" \"Timestamp\": \"20240301\"","160":" }","161":" \"32\": {","162":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQ_TLXLSP_TRXN_WEEKLY\"","163":" \"status\": \"ENDED NOTOK\"","164":" \"Timestamp\": \"20240301\"","165":" }","166":" \"33\": {","167":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_STG_TRADEABR\"","168":" \"status\": \"ENDED NOTOK\"","169":" \"Timestamp\": \"20240301\"","170":" }","171":" \"34\": {","172":" \"jobname\": \"DREAM_BUILD_GDH_MIS_BDV_01\"","173":" \"status\": \"ENDED OK\"","174":" \"Timestamp\": \"20240301\"","175":" }","176":" \"35\": {","177":" \"jobname\": \"DREAM_BUILD_GDH_MIS_BDV_02\"","178":" \"status\": \"ENDED OK\"","179":" \"Timestamp\": \"20240301\"","180":" }","181":" \"36\": {","182":" \"jobname\": \"DREAM_BUILD_GDH_MIS_BDV_03\"","183":" \"status\": \"ENDED OK\"","184":" \"Timestamp\": \"20240301\"","185":" }","186":" \"37\": {","187":" \"jobname\": \"DREAM_BUILD_GDH_MIS_BDV_04\"","188":" \"status\": \"ENDED OK\"","189":" \"Timestamp\": \"20240301\"","190":" }","191":" \"38\": {","192":" \"jobname\": \"DREAM_BUILD_GDH_MIS_BDV_LINK\"","193":" \"status\": \"ENDED OK\"","194":" \"Timestamp\": \"20240301\"","195":" }","196":" \"39\": {","197":" \"jobname\": \"DREAM_BUILD_GDH_MIS_BDV_UNION\"","198":" \"status\": \"ENDED OK\"","199":" \"Timestamp\": \"20240301\"","200":" }","201":" \"40\": {","202":" \"jobname\": \"DREAM_CALC_BDV_CONTROL_COPY\"","203":" \"status\": \"ENDED NOTOK\"","204":" \"Timestamp\": \"20240301\"","205":" }","206":" \"41\": {","207":" \"jobname\": \"DREAM_CDWH_TLX_LSP_3RD_PARTY_TRNS_FACT_OUTBOUND_WEEKLY\"","208":" \"status\": \"ENDED OK\"","209":" \"Timestamp\": \"20240301\"","210":" }","211":" \"42\": {","212":" \"jobname\": \"DREAM_FILE_DELETION_OUTBOUND\"","213":" \"status\": \"ENDED NOTOK\"","214":" \"Timestamp\": \"20240301\"","215":" }","216":" \"43\": {","217":" \"jobname\": \"DREAM_FVDB_TLX_LSP_3RD_PARTY_TRNS_FACT_OUTBOUND_WEEKLY\"","218":" \"status\": \"ENDED OK\"","219":" \"Timestamp\": \"20240301\"","220":" }","221":" \"44\": {","222":" \"jobname\": \"DREAM_FVDB_TOCSV_TLX_LSP_3RD_PARTY_TRNS_FACT_OUTBOUND_WEEKLY\"","223":" \"status\": \"ENDED OK\"","224":" \"Timestamp\": \"20240301\"","225":" }","226":" \"45\": {","227":" \"jobname\": \"DREAM_GVE_GDH_NEW_BUSINESS_FACT_OUTBOUND\"","228":" \"status\": \"ENDED OK\"","229":" \"Timestamp\": \"20240301\"","230":" }","231":" \"46\": {","232":" \"jobname\": \"DREAM_GVE_TLX_LSP_3RD_PARTY_TRNS_FACT_OUTBOUND_WEEKLY\"","233":" \"status\": \"ENDED OK\"","234":" \"Timestamp\": \"20240301\"","235":" }","236":" \"47\": {","237":" \"jobname\": \"DREAM_MEMORY_ALERT_SIT\"","238":" \"status\": \"ENDED OK\"","239":" \"Timestamp\": \"20240301\"","240":" }","241":" \"48\": {","242":" \"jobname\": \"DREAM_MIS_BDV_GMOMIS46_GDH_CORRECTION\"","243":" \"status\": \"ENDED OK\"","244":" \"Timestamp\": \"20240301\"","245":" }","246":" \"49\": {","247":" \"jobname\": \"DREAM_MIS_BDV_TALANXLSP_INVENTORY_THIRD_PARTY_PRE_REQUISITE\"","248":" \"status\": \"ENDED NOTOK\"","249":" \"Timestamp\": \"20240301\"","250":" }","251":" \"50\": {","252":" \"jobname\": \"DREAM_MIS_BDV_TALANX_INSURANCE_PRE_REQUISITE\"","253":" \"status\": \"ENDED OK\"","254":" \"Timestamp\": \"20240301\"","255":" }","256":" \"51\": {","257":" \"jobname\": \"DREAM_MIS_BDV_TALANX_INSURANCE_WEEKLY_PRE_REQUISITE\"","258":" \"status\": \"ENDED OK\"","259":" \"Timestamp\": \"20240301\"","260":" }","261":" \"52\": {","262":" \"jobname\": \"DREAM_MIS_BDV_TALANX_LSP3P_INV\"","263":" \"status\": \"ENDED NOTOK\"","264":" \"Timestamp\": \"20240301\"","265":" }","266":" \"53\": {","267":" \"jobname\": \"DREAM_MIS_BDV_TALANX_LSP3P_TRANSACTION\"","268":" \"status\": \"ENDED NOTOK\"","269":" \"Timestamp\": \"20240301\"","270":" }","271":" \"54\": {","272":" \"jobname\": \"DREAM_MIS_BDV_TSYS_STOCK_PRE_REQUISITE\"","273":" \"status\": \"ENDED NOTOK\"","274":" \"Timestamp\": \"20240301\"","275":" }","276":" \"55\": {","277":" \"jobname\": \"DREAM_MIS_BDV_TSYS_STOCK_PRE_REQUISITE_WEEKLY\"","278":" \"status\": \"ENDED OK\"","279":" \"Timestamp\": \"20240301\"","280":" }","281":" \"56\": {","282":" \"jobname\": \"DREAM_MIS_PRECHECK_TALANXLSPDB_INVENTORY\"","283":" \"status\": \"ENDED NOTOK\"","284":" \"Timestamp\": \"20240301\"","285":" }","286":" \"57\": {","287":" \"jobname\": \"DREAM_MIS_PRECHECK_ZCI_INVENTORY_MONTHLY\"","288":" \"status\": \"ENDED OK\"","289":" \"Timestamp\": \"20240301\"","290":" }","291":" \"58\": {","292":" \"jobname\": \"DREAM_MIS_PRECHECK_ZCI_TRANSACTION_MONTHLY\"","293":" \"status\": \"ENDED OK\"","294":" \"Timestamp\": \"20240301\"","295":" }","296":" \"59\": {","297":" \"jobname\": \"DREAM_MIS_PRECHECK_ZPI_INVENTORY_MONTHLY\"","298":" \"status\": \"ENDED NOTOK\"","299":" \"Timestamp\": \"20240301\"","300":" }","301":" \"60\": {","302":" \"jobname\": \"DREAM_MIS_PRECHECK_ZPI_TRANSACTION_MONTHLY\"","303":" \"status\": \"ENDED OK\"","304":" \"Timestamp\": \"20240301\"","305":" }","306":" \"61\": {","307":" \"jobname\": \"DREAM_MIS_VP_FACTOR_PRE_PROCESSING\"","308":" \"status\": \"ENDED OK\"","309":" \"Timestamp\": \"20240301\"","310":" }","311":" \"62\": {","312":" \"jobname\": \"DREAM_NEW_BUSINESS_DETECTION_TLX_LSP3P_TRANSACTION\"","313":" \"status\": \"ENDED NOTOK\"","314":" \"Timestamp\": \"20240301\"","315":" }","316":" \"63\": {","317":" \"jobname\": \"DREAM_PRECHECK_GDH_DAILY_DATA\"","318":" \"status\": \"ENDED NOTOK\"","319":" \"Timestamp\": \"20240301\"","320":" }","321":" \"64\": {","322":" \"jobname\": \"DREAM_PRECHECK_TLX_DAILY_DATA_LSP3P_INV\"","323":" \"status\": \"ENDED OK\"","324":" \"Timestamp\": \"20240301\"","325":" }","326":" \"65\": {","327":" \"jobname\": \"DREAM_PRECHECK_TLX_DAILY_DATA_LSP3P_TRANSACTION\"","328":" \"status\": \"ENDED NOTOK\"","329":" \"Timestamp\": \"20240301\"","330":" }","331":" \"66\": {","332":" \"jobname\": \"DREAM_PRECHECK_TLX_LSP3P_TRANSACTION_DAILY\"","333":" \"status\": \"ENDED NOTOK\"","334":" \"Timestamp\": \"20240301\"","335":" }","336":" \"67\": {","337":" \"jobname\": \"DREAM_RDL_GDH_NEW_BUSINESS_FACT\"","338":" \"status\": \"ENDED NOTOK\"","339":" \"Timestamp\": \"20240301\"","340":" }","341":" \"68\": {","342":" \"jobname\": \"DREAM_RDL_STG_GDH_NEW_BUSINESS_FACT\"","343":" \"status\": \"ENDED NOTOK\"","344":" \"Timestamp\": \"20240301\"","345":" }","346":" \"69\": {","347":" \"jobname\": \"DREAM_RDL_STG_TLX_LSP_3RD_PARTY_TRNS_FACT\"","348":" \"status\": \"ENDED OK\"","349":" \"Timestamp\": \"20240301\"","350":" }","351":" \"70\": {","352":" \"jobname\": \"DREAM_RDL_STG_TLX_LSP_3RD_PARTY_TRNS_FACT_WEEKLY\"","353":" \"status\": \"ENDED OK\"","354":" \"Timestamp\": \"20240301\"","355":" }","356":" \"71\": {","357":" \"jobname\": \"DREAM_RDL_TLX_LSP_3RD_PARTY_TRNS_FACT\"","358":" \"status\": \"ENDED NOTOK\"","359":" \"Timestamp\": \"20240301\"","360":" }","361":" \"72\": {","362":" \"jobname\": \"DREAM_RDL_TLX_LSP_3RD_PARTY_TRNS_FACT_WEEKLY\"","363":" \"status\": \"ENDED OK\"","364":" \"Timestamp\": \"20240301\"","365":" }","366":" \"73\": {","367":" \"jobname\": \"DREAM_REDUCE_FILE_SIZE\"","368":" \"status\": \"ENDED NOTOK\"","369":" \"Timestamp\": \"20240301\"","370":" }","371":" \"74\": {","372":" \"jobname\": \"DREAM_SDM_STG_GMARS_FDWRISK_FACT\"","373":" \"status\": \"ENDED NOTOK\"","374":" \"Timestamp\": \"20240301\"","375":" }","376":" \"75\": {","377":" \"jobname\": \"DREAM_SDM_STG_TLX_LSP_3RD_PARTY_TRNS_FACT_WEEKLY\"","378":" \"status\": \"ENDED OK\"","379":" \"Timestamp\": \"20240301\"","380":" }","381":" \"76\": {","382":" \"jobname\": \"DREAM_TDM_STG_TALANXLSP_TRANSACTION_THIRD_PARTY_NB_FACT_WEEKLY\"","383":" \"status\": \"ENDED OK\"","384":" \"Timestamp\": \"20240301\"","385":" }","386":" \"77\": {","387":" \"jobname\": \"M002_GVE_SALES_KEY_MATCH_MAP_GVE_TO_DC\"","388":" \"status\": \"ENDED OK\"","389":" \"Timestamp\": \"20240301\"","390":" }","391":" \"78\": {","392":" \"jobname\": \"M003_GVE_AKS_PAYMNET_TRANSACTION_LOAD\"","393":" \"status\": \"ENDED NOTOK\"","394":" \"Timestamp\": \"20240301\"","395":" }","396":"}"}}

Renunaren · ‎08-28-2023

Dataframe row : {"_c0":{"0":"deleted_count","1":"18","2":"8061","3":"0","4":"366619","5":"2","6":"1285","7":"2484","8":"1705","9":"1517","10":"12998","11":"13","12":"57","13":"0","14":"0","15":"0","16":"0","17":"1315","18":"0","19":"0","20":"0","21":"0","22":"0","23":"410973","24":"18588725","25":"0","26":"0","27":"0","28":"0","29":"25238"},"_c1":{"0":"load_date","1":"2023-08-28","2":"2023-08-28","3":"2023-08-28","4":"2023-08-28","5":"2023-08-28","6":"2023-08-28","7":"2023-08-28","8":"2023-08-28","9":"2023-08-28","10":"2023-08-28","11":"2023-08-28","12":"2023-08-28","13":"2023-08-28","14":"2023-08-28","15":"2023-08-28","16":"2023-08-28","17":"2023-08-28","18":"2023-08-28","19":"2023-08-28","20":"2023-08-28","21":"2023-08-28","22":"2023-08-28","23":"2023-08-28","24":"2023-08-28","25":"2023-08-28","26":"2023-08-28","27":"2023-08-28","28":"2023-08-28","29":"2023-08-28"},"_c2":{"0":"redelivered_count","1":"0","2":"1","3":"0","4":"0","5":"0","6":"0","7":"204","8":"0","9":"0","10":"0","11":"0","12":"0","13":"0","14":"0","15":"0","16":"0","17":"0","18":"0","19":"0","20":"0","21":"0","22":"0","23":"0","24":"9293073","25":"0","26":"0","27":"0","28":"0","29":"0"},"_c3":{"0":"table_name","1":"pc_dwh_rdv.gdh_ls2lo_s99","2":"pc_dwh_rdv.gdh_spar_s99","3":"pc_dwh_rdv.cml_kons_s99","4":"pc_dwh_rdv.gdh_tf3tx_s99","5":"pc_dwh_rdv.gdh_wechsel_s99","6":"pc_dwh_rdv.gdh_revolvingcreditcard_s99","7":"pc_dwh_rdv.gdh_phd_s99","8":"pc_dwh_rdv.gdh_npk_s99","9":"pc_dwh_rdv.gdh_npk_s98","10":"pc_dwh_rdv.gdh_kontokorrent_s99","11":"pc_dwh_rdv.gdh_gds_s99","12":"pc_dwh_rdv.gdh_dszins_s99","13":"pc_dwh_rdv.gdh_cml_vdarl_le_ext_s99","14":"pc_dwh_rdv.gdh_cml_vdarl_s99","15":"pc_dwh_rdv.gdh_avale_s99","16":"pc_dwh_rdv.gdh_spar_festzi_s99","17":"pc_dwh_rdv_gdh_monat.gdh_phd_izr_monthly_s99","18":"pc_dwh_rdv.gdh_orig_sparbr_daily_s99","19":"pc_dwh_rdv.gdh_orig_terming_daily_s99","20":"pc_dwh_rdv.gdh_orig_kredite_daily_s99","21":"pc_dwh_rdv.gdh_orig_kksonst_daily_s99","22":"pc_dwh_rdv.gdh_orig_baufi_daily_s99","23":"pc_dwh_rdv_creditcard.credit_card_s99","24":"pc_dwh_rdv_csw.fkn_security_classification_s99","25":"pc_dwh_rdv_loan_appl.ccdb_loan_daily_s99","26":"pc_dwh_rdv_loan_appl.leon_loan_monthly_s99","27":"pc_dwh_rdv_loan_appl.nospk_loan_daily_s99","28":"pc_dwh_rdv_partnrdata.fkn_special_target_group_s99","29":"pc_dwh_rdv_talanx.insurance_s99"}}

Renunaren · ‎07-31-2023

Hi Giuseppe, Thanks for your response. One of our team member has tried using the SPATH command. But he was unable to extract the required data, so we want to extract the data using rex command only. Please help us in this issue.

Renunaren · ‎07-30-2023

Hi Giuseppe, Thanks for your response. We have tried using the mentioned REGEX commands but it hasn't worked here. In our environment we are not authorized to modify props.conf configuration files. Below are some of the snippets that will mention the result. Please look into this and help us on this.

Renunaren · ‎07-27-2023

Dataframe row : {"_c0":{"0":"[","1":" {","2":" \"table_name\": \"pc_dwh_rdv.gdh_ls2lo_s99\"","3":" \"deleted_count\": 18","4":" \"redelivered_count\": 0","5":" \"load_date\": \"2023-07-27\"","6":" }","7":" {","8":" \"table_name\": \"pc_dwh_rdv.gdh_spar_s99\"","9":" \"deleted_count\": 8061","10":" \"redelivered_count\": 1","11":" \"load_date\": \"2023-07-27\"","12":" }","13":" {","14":" \"table_name\": \"pc_dwh_rdv.gdh_tf3tx_s99\"","15":" \"deleted_count\": 366619","16":" \"redelivered_count\": 0","17":" \"load_date\": \"2023-07-27\"","18":" }","19":" {","20":" \"table_name\": \"pc_dwh_rdv.gdh_wechsel_s99\"","21":" \"deleted_count\": 2","22":" \"redelivered_count\": 0","23":" \"load_date\": \"2023-07-27\"","24":" }","25":" {","26":" \"table_name\": \"pc_dwh_rdv.gdh_revolvingcreditcard_s99\"","27":" \"deleted_count\": 1285","28":" \"redelivered_count\": 0","29":" \"load_date\": \"2023-07-27\"","30":" }","31":" {","32":" \"table_name\": \"pc_dwh_rdv.gdh_phd_s99\"","33":" \"deleted_count\": 2484","34":" \"redelivered_count\": 204","35":" \"load_date\": \"2023-07-27\"","36":" }","37":" {","38":" \"table_name\": \"pc_dwh_rdv.gdh_npk_s99\"","39":" \"deleted_count\": 1705","40":" \"redelivered_count\": 0","41":" \"load_date\": \"2023-07-27\"","42":" }","43":" {","44":" \"table_name\": \"pc_dwh_rdv.gdh_npk_s98\"","45":" \"deleted_count\": 1517","46":" \"redelivered_count\": 0","47":" \"load_date\": \"2023-07-27\"","48":" }","49":" {","50":" \"table_name\": \"pc_dwh_rdv.gdh_kontokorrent_s99\"","51":" \"deleted_count\": 12998","52":" \"redelivered_count\": 0","53":" \"load_date\": \"2023-07-27\"","54":" }","55":" {","56":" \"table_name\": \"pc_dwh_rdv.gdh_gds_s99\"","57":" \"deleted_count\": 13","58":" \"redelivered_count\": 0","59":" \"load_date\": \"2023-07-27\"","60":" }","61":" {","62":" \"table_name\": \"pc_dwh_rdv.gdh_dszins_s99\"","63":" \"deleted_count\": 57","64":" \"redelivered_count\": 0","65":" \"load_date\": \"2023-07-27\"","66":" }","67":" {","68":" \"table_name\": \"pc_dwh_rdv_gdh_monat.gdh_phd_izr_monthly_s99\"","69":" \"deleted_count\": 1315","70":" \"redelivered_count\": 0","71":" \"load_date\": \"2023-07-27\"","72":" }","73":"]"}} The above is the sample message of an event which we have in splunk we want to extract the deleted count values like "1315", "57", "13" etc and add those values as a separate fields using rex command . Also from the above message we want to extract load_date value such as 2023-07-27 and add that value as a separate field. Please help us in this.

Renunaren · ‎06-28-2023

We already tried this but this doesn't worked, is there any other way to extract them as a separate fields.

Renunaren · ‎06-28-2023

Hi Team, Please help us on the below issue. Below is the sample event. message: Dataframe row : {"_c0":{"0":"{","1":" \"compaction_table\": [","2":" \"md_proc_control_v2\"","3":" \"md_source_control\"","4":" ]","5":" \"Timestamp\": \"2023\/06\/26 12:05:43\"","6":" \"compaction_status\": \"Successful\"","7":"}"}} In the above message, we have an event with the compaction_table, timestamp and compaction_status. We have tried to extract the files for compaction table such as md_proc_control_v2, md_source_control as a separate field by name List using the below SPL query. index="app_events_dwh2_de_int" _raw=*compac* | rex "(?:\"compaction_table[\\\\]+\": \[)(?<compactionlist>[^\s:]+[^\]]+)" | rex field=compactionlist max_match=0 "(?:[^\s:]+[^\s]+\s[\\\\]+)(?<List>[^\\\]+) But we are unable to extract those files using the above SPL query. We have extracted the compactionlist field like below. But we are unable to extract the List from the field compactionlist. We request you to kindly help us in extraction of the files md_proc_control_v2, md_source_control as separate field by name List and also the compaction status as a separate field and also the Timestamp as a separate field from the event. Below is the sample raw text for this. Dataframe row : {"_c0":{"0":"{","1":" \"compaction_table\": [","2":" \"md_proc_control_v2\"","3":" \"md_source_control\"","4":" ]","5":" \"Timestamp\": \"2023\/06\/26 12:05:43\"","6":" \"compaction_status\": \"Successful\"","7":"}"}}

Renunaren · ‎06-14-2023

Hi IT Whisperer, Thanks for your response. Please look into the sample event below. {"timestamp": "2023-06-13T09:35:27.498033Z", "level": "INFO", "filename": "splunk_sample_csv.py", "funcName": "main", "lineno": 38, "message": "Dataframe row : {\"_c0\":{\"0\":\"{\",\"1\":\" \\\"Timestamp\\\": \\\"2023\\/06\\/13 11:22:45\\\"\",\"2\":\" \\\"status\\\": \\\"files arrived\\\"\",\"3\":\" \\\"files\\\": [\",\"4\":\" \\\"PAKS_FACT_DWH2_D20220221.ok\\\"\",\"5\":\" \\\"PAKS_UBER_DWH2_D20220221.ok\\\"\",\"6\":\" \\\"HHE_SIT_check_file1.txt.ok\\\"\",\"7\":\" \\\"HHE_SIT_check_file2.txt.ok\\\"\",\"8\":\" \\\"HHE_SIT_check_file3.txt.ok\\\"\",\"9\":\" \\\"PAKS_FACT_DWH2_D20220412.ok\\\"\",\"10\":\" \\\"PAKS_FACT_DWH2_D20220420.ok\\\"\",\"11\":\" \\\"PAKS_FACT_DWH2_D20211223.ok\\\"\",\"12\":\" \\\"PAKS_FACT_DWH2_D20211224.ok\\\"\",\"13\":\" \\\"PAKS_FACT_DWH2_D20211225.ok\\\"\",\"14\":\" \\\"NOSPKP2P_DLY_NOK_D230708.ok\\\"\",\"15\":\" \\\"DUMMY_DLY_NOK_D230613.ok\\\"\",\"16\":\" \\\"DUMMY_TEST_DLY_NOK_D230613.ok\\\"\",\"17\":\" \\\"TLX2DB.PROVD.DREAM_12.ok\\\"\",\"18\":\" \\\"TLX2DB.PROVD.DREAM_152.ok\\\"\",\"19\":\" \\\"TLX2DB.PROVD.DREAM_2023-04-19-04.04.32.679000.csv.ok\\\"\",\"20\":\" \\\"TLX2DB.PROVD.DREAM_2023-04-20-05.09.39.679000.csv.ok\\\"\",\"21\":\" \\\"TLX2DB.PROVD.DREAM_2023-04-18-05.09.39.679000.csv.ok\\\"\",\"22\":\" ]\",\"23\":\"}\"}} ", "process": 32633, "processName": "MainProcess"} Please look into the above code and kindly help us in extracting the file names like mentioned above using rex command.

Renunaren · ‎06-14-2023

HI IT Whisperer, Thanks for your response. As mentioned by you, below is the raw event. {"timestamp": "2023-06-13T09:35:27.498033Z", "level": "INFO", "filename": "splunk_sample_csv.py", "funcName": "main", "lineno": 38, "message": "Dataframe row : {\"_c0\":{\"0\"😕"{\",\"1\"😕" \\\"Timestamp\\\": \\\"2023\\/06\\/13 11:22:45\\\"\",\"2\"😕" \\\"status\\\": \\\"files arrived\\\"\",\"3\"😕" \\\"files\\\": [\",\"4\"😕" \\\"PAKS_FACT_DWH2_D20220221.ok\\\"\",\"5\":\" \\\"PAKS_UBER_DWH2_D20220221.ok\\\"\",\"6\":\" \\\"HHE_SIT_check_file1.txt.ok\\\"\",\"7\":\" \\\"HHE_SIT_check_file2.txt.ok\\\"\",\"8\":\" \\\"HHE_SIT_check_file3.txt.ok\\\"\",\"9\":\" \\\"PAKS_FACT_DWH2_D20220412.ok\\\"\",\"10\":\" \\\"PAKS_FACT_DWH2_D20220420.ok\\\"\",\"11\":\" \\\"PAKS_FACT_DWH2_D20211223.ok\\\"\",\"12\":\" \\\"PAKS_FACT_DWH2_D20211224.ok\\\"\",\"13\":\" \\\"PAKS_FACT_DWH2_D20211225.ok\\\"\",\"14\":\" \\\"NOSPKP2P_DLY_NOK_D230708.ok\\\"\",\"15\":\" \\\"DUMMY_DLY_NOK_D230613.ok\\\"\",\"16\":\" \\\"DUMMY_TEST_DLY_NOK_D230613.ok\\\"\",\"17\":\" \\\"TLX2DB.PROVD.DREAM_12.ok\\\"\",\"18\":\" \\\"TLX2DB.PROVD.DREAM_152.ok\\\"\",\"19\":\" \\\"TLX2DB.PROVD.DREAM_2023-04-19-04.04.32.679000.csv.ok\\\"\",\"20\":\" \\\"TLX2DB.PROVD.DREAM_2023-04-20-05.09.39.679000.csv.ok\\\"\",\"21\":\" \\\"TLX2DB.PROVD.DREAM_2023-04-18-05.09.39.679000.csv.ok\\\"\",\"22\":\" ]\",\"23\"😕"}\"}} ", "process": 32633, "processName": "MainProcess"} I tried to extract the file names like PAKS_FACT_DWH2_D20220221.ok, PAKS_UBER_DWH2_D20220221.ok, HHE_SIT_check_file1.txt.ok, HHE_SIT_check_file2.txt.ok, HHE_SIT_check_file3.txt.ok separately and add them as a separate field using the below query index= app_events_dwh2_de_int | rex max_match=0 "\\\\\\\\\\\\\"files\\\\\\\\\\\\\":\s*\\\\\\\\\\\\\"(?<File_Arrived>[^\\\]+)" but this doesn't worked. Please help us on this issue.

Renunaren · ‎06-14-2023

Hi Team, We have a raw event where the message field consists of multiple file names, we want to extract those and add them as a separate field. Please help us on this. Below is the sample event for reference. {"timestamp": "2023-06-13T09:35:27.498033Z", "level": "INFO", "filename": "splunk_sample_csv.py", "funcName": "main", "lineno": 38, "message": "Dataframe row : {\"_c0\":{\"0\"😕"{\",\"1\"😕" \\\"Timestamp\\\": \\\"2023\\/06\\/13 11:22:45\\\"\",\"2\"😕" \\\"status\\\": \\\"files arrived\\\"\",\"3\"😕" \\\"files\\\": [\",\"4\"😕" \\\"PAKS_FACT_DWH2_D20220221.ok\\\"\",\"5\":\" \\\"PAKS_UBER_DWH2_D20220221.ok\\\"\",\"6\":\" \\\"HHE_SIT_check_file1.txt.ok\\\"\",\"7\":\" \\\"HHE_SIT_check_file2.txt.ok\\\"\",\"8\":\" \\\"HHE_SIT_check_file3.txt.ok\\\"\",\"9\":\" \\\"PAKS_FACT_DWH2_D20220412.ok\\\"\",\"10\":\" \\\"PAKS_FACT_DWH2_D20220420.ok\\\"\",\"11\":\" \\\"PAKS_FACT_DWH2_D20211223.ok\\\"\",\"12\":\" \\\"PAKS_FACT_DWH2_D20211224.ok\\\"\",\"13\":\" ]\",\"23\"😕"}\"}} ", "process": 32633, "processName": "MainProcess"} Below is the sample SPL command used for this purpose. index= app_events_dwh2_de_int | rex max_match=0 "\\\\\\\\\\\\\"files\\\\\\\\\\\\\":\s*\\\\\\\\\\\\\"(?<File_Arrived>[^\\\]+)" Please help us on this.

Renunaren · ‎06-12-2023

We have created a XML dashboard for infrastructure monitoring, where the panes for CPU utilization , RAM utilization, File Count and Storage utilization are like in the below snippet. I am able to see the above dashboards and the values in the graphs , radial gauge, and filler gauges, but our team members are not able to see those values, Graphs and gauges even though they have the same permissions like me to the dashboard. Once they try to open the dashboard they are seeing like in the below snippet. Below is the sample xml code that has been given for the dashboard panels. <panel id="CPU_Information"> <html> <H1 style="text-align:center;background-color:#0080ff;">CPU Information (In Percentage)</H1> </html> <html> <style> #CPU_Information{ height: 25px; } #CPU_Information{ width:35% !important; } </style> </html> <chart> <search> <query>index="app_events_dwh2_de_int" _raw=*cpu* | rex ": %utilization\",.+:\"(?<CPU_Utilization>[\d\.]+)" | rex max_match=0 ":\\\\\"(?<TIME>\d\d:\d\d:\d\d)" | chart Values(CPU_Utilization) over TIME</query> <earliest>$Infra Time Select.earliest$</earliest> <latest>$Infra Time Select.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.backgroundColor">#FFFFFF</option> <option name="charting.chart">line</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option> <option name="charting.fontColor">#000000</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="height">125</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </chart> <html> <H1 style="text-align:center;background-color:#0080ff;">RAM Information (in KB)</H1> </html> <chart> <search> <query>index="app_events_dwh2_de_int" _raw=*kbswpused* | rex max_match=0 "\\\\\\\\\\\\\"kbswpused\\\\\\\\\\\\\":\d*\\\\\\\\\\\\\"(?<Swap_used>[^\\\]+)" | rex max_match=0 ":\\\\\"(?<TIME>\d\d:\d\d:\d\d)" | eval Swap_Used(GB)=round(Swap_Used/1024/1024,3) | chart Values(Swap_Used(GB)) over TIME</query> <earliest>$Infra Time Select.earliest$</earliest> <latest>$Infra Time Select.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.backgroundColor">#FFFFFF</option> <option name="charting.chart">line</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">connect</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option> <option name="charting.fieldColors">{"Success": 0x009900, "Error": 0xFF0000, "Wait": 0xFF9900, "Running": 0x0047AB}</option> <option name="charting.fontColor">#000000</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="height">231</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </chart> </panel> <panel id="File_Information"> <html> <H1 style="text-align:center;background-color:#0080ff;">FILE Count(in thousands)</H1> <style> #File_Information{ height:25px !important; } #File_Information{ width:35% !important; } </style> </html> <chart> <search> <query>index="app_events_dwh2_de_int" _raw=*File_count* | rex max_match=0 "\\\\\\\\\\\\\"File_count\\\\\\\\\\\\\":d*\\\\\\\\\\\\\"(?<File_Count>[^\\\]+)" | stats latest(File_Count) as File_Count | chart Values(File_Count)</query> <earliest>$FileCount and Storage.earliest$</earliest> <latest>$FileCount and Storage.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.backgroundColor">#ffffff</option> <option name="charting.chart">fillerGauge</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">all</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.fieldColors">{"Success": 0x009900, "Error": 0xFF0000, "Wait": 0xFF9900, "Running": 0x0047AB}</option> <option name="charting.fontColor">black</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="height">145</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">small</option> <option name="trellis.splitBy">_aggregation</option> </chart> <html> <H1 style="text-align:center;background-color:#0080ff;">Storage Consumption (in GB)</H1> </html> <chart> <search> <query>index="app_events_dwh2_de_int" _raw=*File_Count* | rex max_match=0 "\\\\\\\\\\\\\"CONTENT_SIZE\\\\\\\\\\\\\":\d*\\\\\\\\\\\\\"(?<Storage>[^\\\]+)" | stats latest(Storage) as Storage | chart Values(Storage)</query> <earliest>$FileCount and Storage.earliest$</earliest> <latest>$FileCount and Storage.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.backgroundColor">#FFFFFF</option> <option name="charting.chart">radialGauge</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.chart.style">shiny</option> <option name="charting.fieldColors">{"Success": 0x009900, "Error": 0xFF0000, "Wait": 0xFF9900, "Running": 0x0047AB}</option> <option name="charting.fontColor">#000000</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="height">253</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </chart> </panel> </row> We request you to kindly look into the above and do the needful

Renunaren · ‎06-12-2023

Hi Team, We have created a splunk XML dashboard for our infra structure monitoring. Below is a snippet regarding the dashboard. I am able to see the graphs related to cpu information, RAM information, File count, Storage Consumption information. But our colleagues are not able to see the information and below is the snippet related to the same dashboard for them. Below is the sample XML code for this dashboard which we have used. <row> <panel id="chart_width"> <title></title>    <html> <H1 style="text-align:center;background-color:#0080ff;">Daily Monitoring Dashboard</H1> </html> <html> <style> .dashboard-row .dashboard-panel h2.panel-title{ font-size: 20px !important; } #chart_width{ width:30% !important; } </style> </html> <chart> <search> <query>index= app_events_dwh2_de_int *(*Error*) | eval status="Error"| fields + status | append [ search index= app_events_dwh2_de_int *(*Success*) | eval status="Success" | fields + status ] | append [ search index= app_events_dwh2_de_int *(*Wait*) | eval status="Wait" | fields + status ] | append [ search index= app_events_dwh2_de_int *(*Running*) | eval status="Running" | fields + status ] | stats count by status</query> <earliest>$Daily Monitoring Dashboard.earliest$</earliest> <latest>$Daily Monitoring Dashboard.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.backgroundColor">#ffffff</option> <option name="charting.chart">pie</option> <option name="charting.chart.bubbleMaximumSize">100</option> <option name="charting.chart.bubbleMinimumSize">60</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">all</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option> <option name="charting.fieldColors">{"Success": 0x009900, "Error": 0xFF0000, "Wait": 0xFF9900, "Running": 0x0047AB}</option> <option name="charting.fontColor">black</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">none</option> <option name="charting.lineWidth">2</option> <option name="height">125</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">small</option> <option name="trellis.splitBy">_aggregation</option> </chart> <html> <H1 style="text-align:center;background-color:#0080ff;">Stats Table</H1> </html> <html> <style> </style> </html> <table> <search> <query>index= app_events_dwh2_de_int *(*Error*) | eval status="Error"| fields + status | append [ search index= app_events_dwh2_de_int *(*Success*) | eval status="Success" | fields + status ] | append [ search index= app_events_dwh2_de_int *(*Wait*) | eval status="Wait" | fields + status ] | append [ search index= app_events_dwh2_de_int *(*Running*) | eval status="Running" | fields + status ] | stats count by status</query> <earliest>$Stats Table.earliest$</earliest> <latest>$Stats Table.latest$</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> <format type="color" field="status"> <colorPalette type="map">{"Success":#FFFFFF,"Running":#FFFFFF,"Wait":#FFFFFF,"Error":#FFFFFF}</colorPalette> </format> <format type="number" field="status"></format> <format type="color" field="count"> <colorPalette type="minMidMax" maxColor="#FFFFFF" minColor="#FFFFFF"></colorPalette> <scale type="minMidMax"></scale> </format> </table> </panel> <panel id="CPU_Information"> <html> <H1 style="text-align:center;background-color:#0080ff;">CPU Information (In Percentage)</H1> </html> <html> <style> #CPU_Information{ height: 25px; } #CPU_Information{ width:35% !important; } </style> </html> <chart> <search> <query>index="app_events_dwh2_de_int" _raw=*cpu* | rex ": %utilization\",.+:\"(?<CPU_Utilization>[\d\.]+)" | rex max_match=0 ":\\\\\"(?<TIME>\d\d:\d\d:\d\d)" | chart Values(CPU_Utilization) over TIME</query> <earliest>$Infra Time Select.earliest$</earliest> <latest>$Infra Time Select.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.backgroundColor">#FFFFFF</option> <option name="charting.chart">line</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option> <option name="charting.fontColor">#000000</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="height">125</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </chart> <html> <H1 style="text-align:center;background-color:#0080ff;">RAM Information (in KB)</H1> </html> <chart> <search> <query>index="app_events_dwh2_de_int" _raw=*kbswpused* | rex max_match=0 "\\\\\\\\\\\\\"kbswpused\\\\\\\\\\\\\":\d*\\\\\\\\\\\\\"(?<Swap_used>[^\\\]+)" | rex max_match=0 ":\\\\\"(?<TIME>\d\d:\d\d:\d\d)" | eval Swap_Used(GB)=round(Swap_Used/1024/1024,3) | chart Values(Swap_Used(GB)) over TIME</query> <earliest>$Infra Time Select.earliest$</earliest> <latest>$Infra Time Select.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.backgroundColor">#FFFFFF</option> <option name="charting.chart">line</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">connect</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option> <option name="charting.fieldColors">{"Success": 0x009900, "Error": 0xFF0000, "Wait": 0xFF9900, "Running": 0x0047AB}</option> <option name="charting.fontColor">#000000</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="height">231</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </chart> </panel> <panel id="File_Information"> <html> <H1 style="text-align:center;background-color:#0080ff;">FILE Count(in thousands)</H1> <style> #File_Information{ height:25px !important; } #File_Information{ width:35% !important; } </style> </html> <chart> <search> <query>index="app_events_dwh2_de_int" _raw=*File_count* | rex max_match=0 "\\\\\\\\\\\\\"File_count\\\\\\\\\\\\\":d*\\\\\\\\\\\\\"(?<File_Count>[^\\\]+)" | stats latest(File_Count) as File_Count | chart Values(File_Count)</query> <earliest>$FileCount and Storage.earliest$</earliest> <latest>$FileCount and Storage.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.backgroundColor">#ffffff</option> <option name="charting.chart">fillerGauge</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">all</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.fieldColors">{"Success": 0x009900, "Error": 0xFF0000, "Wait": 0xFF9900, "Running": 0x0047AB}</option> <option name="charting.fontColor">black</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="height">145</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">small</option> <option name="trellis.splitBy">_aggregation</option> </chart> <html> <H1 style="text-align:center;background-color:#0080ff;">Storage Consumption (in GB)</H1> </html> <chart> <search> <query>index="app_events_dwh2_de_int" _raw=*File_Count* | rex max_match=0 "\\\\\\\\\\\\\"CONTENT_SIZE\\\\\\\\\\\\\":\d*\\\\\\\\\\\\\"(?<Storage>[^\\\]+)" | stats latest(Storage) as Storage | chart Values(Storage)</query> <earliest>$FileCount and Storage.earliest$</earliest> <latest>$FileCount and Storage.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.backgroundColor">#FFFFFF</option> <option name="charting.chart">radialGauge</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.chart.style">shiny</option> <option name="charting.fieldColors">{"Success": 0x009900, "Error": 0xFF0000, "Wait": 0xFF9900, "Running": 0x0047AB}</option> <option name="charting.fontColor">#000000</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="height">253</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </chart> </panel> </row> I request you to kindly look into this and do the needful.

Renunaren · ‎06-01-2023

Hi Manasa, Thanks for your valuable reply, this has worked actually.

Renunaren · ‎05-30-2023

Hi Team, We have a splunk XML dashboard as shown in the below snippet. In the above table we have extracted the job names from the raw text and arranged those job names in the splunk dashboard table, where we can see that all job names are in single cell but we need those job names divided into separate cells with the same time stamp. Please help us on this. Below is the SPL query we have given for the table and the xml code given for the table. index= app_events_dwh2_de_int _raw=*(*Error*) | eval status="Error" | rex max_match=0 "\\\\\\\\\\\\\"name\\\\\\\\\\\\\":\s*\\\\\\\\\\\\\"(?<name>[^\\\]+)" | append [ search index=app_events_dwh2_de_int _raw=*(*Error*) | eval rootcause=exc_info] |table "_time", "name", status, rootcause <panel id="Error_table"> <html> <H1 style="text-align:center;background-color:#0080FF;">Error Event Details</H1> <style> #Error_table { width: 70% !important; } #Error_table1 table thead tr th:nth-child(1){ width: 25% !important; } #Error_table1 table thead tr th:nth-child(3){ width: 10% !important; } #Error_table1 table thead tr th:nth-child(2){ width: 25% !important; } #Error_table1 table thead tr th:nth-child(4){ width: 40% !important; } #Error_table1 table td { row-height: 5px !important; } </style> </html> <table id="Error_table1"> <search> <query>index= app_events_dwh2_de_int _raw=*(*Error*) | eval status="Error" | rex max_match=0 "\\\\\\\\\\\\\"name\\\\\\\\\\\\\":\s*\\\\\\\\\\\\\"(?<name>[^\\\]+)" | append [ search index=app_events_dwh2_de_int _raw=*(*Error*) | eval rootcause=exc_info] |table "_time", "name", status, rootcause</query> <earliest>0</earliest> <latest></latest> <sampleRatio>1</sampleRatio> </search> <option name="count">6</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="refresh.display">progressbar</option> <option name="wrap">true</option> <format type="color" field="name"> <colorPalette type="minMidMax" maxColor="#FFFFFF" minColor="#FFFFFF"></colorPalette> <scale type="minMidMax"></scale> </format> <format type="color" field="status"> <colorPalette type="map">{"Error":#FFFFFF}</colorPalette> </format> </table> </panel>

Renunaren · ‎05-29-2023

Hi Team, Please help us on the dashboard issue, we have a splunk xml dashboard table as shown in the below snippet. In the root cause column the entire event is coming . We need help so that the entire event should be adjusted to 4 lines and if required the column width can extend as per the event.

Renunaren · ‎05-18-2023

Hi Team, We have dashboard which will contains the daily job related information. In that we have two panels like below one is stats table and the other is Daily monitoring Dashboard panels. They are in the same row but they are separate panels, we need those panels to be merged to one. Below are the information related to panels. Is there any possible way for this, please help us on this.

Posts	60
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎01-30-2023

Online Status	Offline
Date Last Visited	3 weeks ago

Need to filter particular job name from the list o...

Facing issue while extracting required fields and ...

Facing Issue with Extraction of fields using rex

Unable to extract the Time stamp value from the me...

How to extract deleted count values from the below...

How to extract a value from the message using rex ...

Can't extract fields and make list?

How can I extract multiple file names from an even...

Why are teammates unable to view values, graphs, a...

Why can't I see the graphs related to cpu informat...

Re: Need to filter particular job name from the li...

Need to filter particular job name from the list o...

Re: Facing issue while extracting required fields ...

Re: Facing issue while extracting required fields ...

Facing issue while extracting required fields and ...

Re: Facing Issue with Extraction of fields using r...

Facing Issue with Extraction of fields using rex

Re: Unable to extract the Time stamp value from th...

Re: Unable to extract the Time stamp value from th...

Unable to extract the Time stamp value from the me...

How to extract deleted count values from the below...

Re: Need help in extraction of a value from the me...

Re: Need help in extraction of a value from the me...

How to extract a value from the message using rex ...

Re: Issue with SPL query

Can't extract fields and make list?

Re: Need Help in extraction of multiple file names...

Re: Need Help in extraction of multiple file names...

How can I extract multiple file names from an even...

Why are teammates unable to view values, graphs, a...

Why can't I see the graphs related to cpu informat...

Re: Need Help on Splunk XML dashboard table

How to get job names divided into separate cells w...

How to fix the row height and extend the cell widt...

How to merge two panels into one panel in a single...