Hi All,
I have a list of invoice numbers that I want to try and find data for in Splunk. I added the list in a CSV but am having trouble getting other values in Splunk related to those InvoiceNumbers.
Here is where I have left off:
index=contract_gateway sourcetype=esb_audit bp_bp_name=Invoice
| join type=outer InvoiceNumber [ | inputlookup ctg_invoice_check_lookup.csv | table InvoiceNumber ]
Along with this list I want to find other fields being logged (if they have even logged initally)...something like:
...| stats first(InvoiceNumber) as InvoiceNumber, latest(status) as exit_status, latest(other) as exit_message by bp_context_id
is there a way to "append" these values with the list of invoice numbers in Splunk if they are being logged?
Thanks in advance!
Try it this way instead for your first search:
index=contract_gateway sourcetype=esb_audit bp_bp_name=Invoice [ | inputlookup ctg_invoice_check_lookup.csv
| table InvoiceNumber ]
This will retrieve the events with the InvoiceNumber(s) in the lookup table. I am unclear about the second part of your question, but you could try this:
... | stats first(InvoiceNumber) as InvoiceNumber, latest(status) as exit_status, latest(other) as exit_message
values(InvoiceNumber) as AllInvoices by bp_context_id
Try it this way instead for your first search:
index=contract_gateway sourcetype=esb_audit bp_bp_name=Invoice [ | inputlookup ctg_invoice_check_lookup.csv
| table InvoiceNumber ]
This will retrieve the events with the InvoiceNumber(s) in the lookup table. I am unclear about the second part of your question, but you could try this:
... | stats first(InvoiceNumber) as InvoiceNumber, latest(status) as exit_status, latest(other) as exit_message
values(InvoiceNumber) as AllInvoices by bp_context_id
sorry for the late response on this.
This is exactly what I did - thanks for your response!