Splunk Search

How can I write a search with a multifield value for job type and organization?

kteng2024
Path Finder

Hi there,

Below is the query for which i need the multi field value for job type and organization.

index=abc sourcetype=xyz source="/var/log/companies" Status=finished| eval  time=strptime(ScheduleTime, "%Y-%m-%d %H:%M:%S")
|eval st=strptime(WorkerStartTime, "%Y-%m-%d %H:%M:%S.%3N")
| eval et=strptime(WorkerEndTime, "%Y-%m-%d %H:%M:%S.%3N")
| eval duration = et - st| table Schedule_time , Type, Name, organization,  Host, length

output

Schedule_time               JobType          JobName        Organization                    Host                  length
2017-11-30 00:00:00.000       abc             compact              Google               apacheweb               73689.96
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

To get that, you need to tell us what the incoming data looks like, exact field names and all.

You also need to get in the habit o aking sure to check the spelling and case of everything you code and post. Does organization have a capital "O" or not? Is the field called Name or JobName? Type or JobType? duration or length?

Here's a complete stab in the dark, which you'll have to adjust with the exact right spelling of the fields....

index=abc sourcetype=xyz source="/var/log/companies" Status=finished
| fields ScheduleTime WorkerStartTime WorkerEndTime, Organization, Host, JobType, JobName
| eval time=strptime(ScheduleTime, "%Y-%m-%d %H:%M:%S")
| eval st=strptime(WorkerStartTime, "%Y-%m-%d %H:%M:%S.%3N")
| eval et=strptime(WorkerEndTime, "%Y-%m-%d %H:%M:%S.%3N")
| eval DurationHrs = round( (et - st)/3600,2)
| table _time, ScheduleTime, JobType, JobName, Organization, Host, DurationHrs

Then, if you want to add up all those by JobType and JobName, then

| stats min(_time) as _time sum(DurationHrs) as DurationHrs by JobType, JobName, Organization, Host

or

| stats min(_time) as _time sum(DurationHrs) as DurationHrs values(JobName) as JobName by JobType, Organization, Host
0 Karma

woodcock
Esteemed Legend

You have not shown any data nor explained how your search is failing.

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Example data? Be sure to use the 101010 button to show the data exactly. If it is secured data, at least anonymize it, but example data is needed.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...