Splunk Search

Get the latest event status of the Jobs (re-submitted repeatedly)

arulbalans
Engager

Splunk Query:

2016-06-12 00:48:29,834 INFO  [MainThread][PID:3143] item: AR001SJFBS valid_audio_path: /PROXY_AUDIO/2011/05/31/AR001SJFBS_3.mp2||/PROXY_AUDIO/2011/05/31/AR001SJFBS_4.mp2
2016-06-12 00:48:29,834 INFO  [MainThread][PID:3143] Item Submitted :: AR001SJFBS
2016-06-12 00:48:40,730 INFO  [MainThread][PID:3143] Item Processed :: AR001SJFBS, Transcode Status :: error

2016-06-27 08:30:20,169 INFO  [MainThread][PID:29112] item: AR001SJFBS valid_audio_path: /PROXY_AUDIO/2011/05/31/AR001SJFBS_3.mp2||/PROXY_AUDIO/2011/05/31/AR001SJFBS_4.mp2
2016-06-27 08:30:20,169 INFO  [MainThread][PID:29112] Item Submitted :: AR001SJFBS
2016-06-27 08:51:56,680 INFO  [MainThread][PID:29112] update metadat:: file system check True, new access path L:\PROXY\2011\05\31\AR001SJFBS.mp4
2016-06-27 08:52:13,879 INFO  [MainThread][PID:29112] Existing proxy backup at P:\MPEG_Backup\PROXY\2011\05\31\AR001SJFBS.mpeg ::
2016-06-27 08:52:13,879 INFO  [MainThread][PID:29112] Item Processed :: AR001SJFBS, Transcode Status :: completed 

From the above log
I'm re-submitting jobs that are failed with error/aborted/failed status. So possibilities of repeated proxies are present in the list.
I have to treat the transcode status of "AR001SJFBS" as "completed" instead "error" since completed is the latest status.

Thanks, Arul

0 Karma
1 Solution

sundareshr
Legend

Try this

... | rex "PID:(?<job>\d+)\]\sItem\s(|?<status>\w+)" | eval status=if(status="AR*", "Completed", status) | stats latest(status) as status by job

View solution in original post

0 Karma

sundareshr
Legend

Try this

... | rex "PID:(?<job>\d+)\]\sItem\s(|?<status>\w+)" | eval status=if(status="AR*", "Completed", status) | stats latest(status) as status by job
0 Karma

arulbalans
Engager

Thank you Sundaresh!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...