Hi,
I am trying to create a search to check if my jobs are meeting SLA or not, but I am not able to get the search right.
Requirement is I have 10 jobs and their SLA are different. Please find the sample below.
Job SLA
Kh8000 7:30
Kh1432 8:00
Kh8900 7:30
Kh5606 7:00
Kh4001 8:00
Kh6123 8:00
By using the search below, I am able to return data only for one job ant able to place all jobs. Can you please help me edit this search?
index=ops sourcetype="tws_merged" host=cplita22.homedepot.com (job_name =kh8900 ) | transaction job_name job_number | eval job_completed=if(match(_raw, "SUCCESSFULLY"), 1, 0) | eval job_did_start=_time | eval job_did_finish=if(job_completed==1, _time+duration, null()) | rename job_cpu_name AS job_server | rename job_stream_name AS job_schedule | eval seconds=job_did_finish-job_did_start | sec2str | rename seconds_human as | sort - seconds | rename job_did_start as _time job_did_finish as end_time job_server as job_cpu_name | eval Dayofweek = strftime(_time,"%A") | eval Start_time =strftime(_time, "%H:%M:%S") | eval DATE=strftime(_time, "%m/%d/%Y") | eval endtime_ep=_time+seconds | eval sla_cutoff=DATE." 07:30:00" | eval sla_cutoff1=strptime(sla_cutoff, "%m/%d/%Y %H:%M:%S") | convert ctime(endtime_ep) as endtime| eval sla_status = if(endtime_ep>sla_cutoff1, "MISS", "OK") | table DATE Dayofweek Start_time Application_Name job_schedule job_name duration endtime sla_status | sort date job_schedule job_name
... View more