Splunk Search

How to get multiple events in single row of table?

archananaveen
Explorer

I search logs for these strings: "member left" OR "left cluster" OR "asking member". It gives below output. These events are related to a node/ member and come different sources across hosts. Now I want to display in a table time "asking member leave time" and "notice event time" in a single row. How can I achieve this?

[DEBUG] 2018-01-28 23:07:37.193/40.500 Oracle Coherence GE 12.2.1.0.1  (thread=DistributedCache:DED-OTCM-PartitionedService, member=2): Asking member 1 for primary ownership of PartitionSet{0, 3, 6, 9, 12, 15, 18, 21, 24, 27, 30, 33, 36, 39, 42, 45, 48, 51, 54, 57, 60, 63, 66, 69, 72, 75, 78, 81, 84, 87, 90, 93, 96, 99, 102, 105, 108, 111, 114, 117, 120, 123, 126, 129, 132, 135, 138, 141, 144, 147, 150, 153, 156, 159, 162, 165, 168, 171, 174, 177, 180, 183, 186, 189, 192, 195, 198, 201, 204, 207, 210, 213, 216, 219, 222, 225, 228, 231, 234, 237, 240, 243, 246, 249, 252, 255, 258, 261, 264, 267, 270, 273, 276, 279, 282, 285, 288, 291, 294, 297, 300, 303, 306, 309, 312, 315, 318, 321, 324, 327, 330, 333, 336, 339, 342, 345, 348, 351, 354, 357, 360, 363, 366, 369, 372, 375, 378, 381, 384, 387, 390, 393, 396, 399, 402, 405, 408, 411, 414, 417, 420, 423, 426, 429}


[DEBUG] 2018-01-28 23:07:37.145/40.452 Oracle Coherence GE 12.2.1.0.1  (thread=DistributedCache:DED-OTC-PartitionedService, member=2): Asking member 1 for primary ownership of PartitionSet{0, 3, 6, 9, 12, 15, 18, 21, 24, 27, 30, 33, 36, 39, 42, 45, 48, 51, 54, 57, 60, 63, 66, 69, 72, 75, 78, 81, 84, 87, 90, 93, 96, 99, 102, 105, 108, 111, 114, 117, 120, 123, 126, 129, 132, 135, 138, 141, 144, 147, 150, 153, 156, 159, 162, 165, 168, 171, 174, 177, 180, 183, 186, 189, 192, 195, 198, 201, 204, 207, 210, 213, 216, 219, 222, 225, 228, 231, 234, 237, 240, 243, 246, 249, 252, 255, 258, 261, 264, 267, 270, 273, 276, 279, 282, 285, 288, 291, 294, 297, 300, 303, 306, 309, 312, 315, 318, 321, 324, 327, 330, 333, 336, 339, 342, 345, 348, 351, 354, 357, 360, 363, 366, 369, 372, 375, 378, 381, 384, 387, 390, 393, 396, 399, 402, 405, 408, 411, 414, 417, 420, 423, 426, 429}

[DEBUG] 2018-01-28 23:04:13.308/86254.373 Oracle Coherence GE 12.2.1.0.1  (thread=Cluster, member=8): Member(Id=5, Timestamp=2018-01-28 23:04:13.308, Address=1.1.1.19:10088, MachineId=64900, Location=machine:xxxxxx4a0209,process:29828,member:MRC-OTC-Partitioned-node4, Role=CoherenceServer) left Cluster with senior member 8

[DEBUG] 2018-01-28 23:04:13.016/86254.081 Oracle Coherence GE 12.2.1.0.1  (thread=Cluster, member=8): Member(Id=6, Timestamp=2018-01-28 23:04:13.016, Address=1.1.1.17:10090, MachineId=9445, Location=machine:xxxxxx3a0209,process:130402,member:MRC-OTC-Extend-node7, Role=CoherenceServer) left Cluster with senior member 5

[DEBUG] 2018-01-28 23:04:12.957/86254.022 Oracle Coherence GE 12.2.1.0.1  (thread=Cluster, member=8): Member(Id=7, Timestamp=2018-01-28 23:04:12.957, Address=1.1.1.17:10088, MachineId=9445, Location=machine:xxxxxx3a0209,process:130202,member:MRC-OTC-Partitioned-node3, Role=CoherenceServer) left Cluster with senior member 5

[DEBUG] 2018-01-28 23:04:12.707/86253.772 Oracle Coherence GE 12.2.1.0.1  (thread=Cluster, member=8): Member(Id=3, Timestamp=2018-01-28 23:04:12.707, Address=1.1.1.15:10090, MachineId=19526, Location=machine:xxxxxx2a0209,process:101777,member:MRC-OTC-Extend-node6, Role=CoherenceServer) left Cluster with senior member 5
0 Karma

archananaveen
Explorer

Yes fields are common. However, notice messages has Member(Id=*** in it. I want to construct a table rows if Member(Id= is false. In that row, I want to add the timestamp of events having Member(Id=** and the ID number. Can you please suggest?

_time    Departure Node      Notice Node         Notice node timestamp

xxxxx    member 2                member 8             xxxxxxxx
0 Karma

somesoni2
SplunkTrust
SplunkTrust

What should be the output based on your sample data? There are multiple events with string "asking member" and "left cluster", so which should be considered for timestamps?

0 Karma

archananaveen
Explorer

Thanks for your comment. I see your point. For now let's leave the duplicates we are seeing for asking member. However, we would need to consider all the events for left cluster. Do you have any suggestion on how to do that?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

So out of all the events for left cluster, whose timestamp should we take? Again, What should be the output based on your sample data?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Do all these events have a common field? If yes, then you can use stats to group multiple events into single row. E.g.

your current search which includes commonField and otherField1, otherField2...
| stats values(otherField1) as otherField1 values(otherField2) as otherField2... by commonField
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...