Apologies for the delayed response. I'm fairly new to Splunk so only kow basics at the moment, below i've shown more lines this is within the log file. The SQL code is usually under [PROC SQL;] .. These logs are generated from SAS to show what users are building in their query. My main aim is to add the sql code into a report in Splunk and possibly set it up to extract as a field? Would this be possible. I've looked into look ups but I don't think that is possible....
2017-04-24 12:11:47,617 [18] DEBUG JobSpy [(null)] - [OPTIONS DEV=ACTIVEX;]
2017-04-24 12:11:47,617 [18] DEBUG JobSpy [(null)] - [GOPTIONS XPIXELS=0 YPIXELS=0;]
2017-04-24 12:11:47,617 [18] DEBUG JobSpy [(null)] - [FILENAME EGSR TEMP;]
2017-04-24 12:11:47,617 [18] DEBUG JobSpy [(null)] - [ODS tagsets.sasreport13(ID=EGSR) FILE=EGSR]
2017-04-24 12:11:47,617 [18] DEBUG JobSpy [(null)] - [ STYLE=HtmlBlue]
2017-04-24 12:11:47,617 [18] DEBUG JobSpy [(null)] - [ STYLESHEET=(URL="file:///R:/SASHome/SASEnterpriseGuide/7.1/Styles/HtmlBlue.css")]
2017-04-24 12:11:47,617 [18] DEBUG JobSpy [(null)] - [ NOGTITLE]
2017-04-24 12:11:47,617 [18] DEBUG JobSpy [(null)] - [ NOGFOOTNOTE]
2017-04-24 12:11:47,617 [18] DEBUG JobSpy [(null)] - [ GPATH=&sasworklocation]
2017-04-24 12:11:47,617 [18] DEBUG JobSpy [(null)] - [ ENCODING=UTF8]
2017-04-24 12:11:47,617 [18] DEBUG JobSpy [(null)] - [ options(rolap="on")]
2017-04-24 12:11:47,617 [18] DEBUG JobSpy [(null)] - [;]
2017-04-24 12:11:47,617 [18] DEBUG JobSpy [(null)] - []
2017-04-24 12:11:47,617 [18] DEBUG JobSpy [(null)] - [GOPTIONS ACCESSIBLE;]
2017-04-24 12:11:47,617 [18] DEBUG JobSpy [(null)] - [%_eg_conditional_dropds(WORK.QUERY_F);]
2017-04-24 12:11:47,617 [18] DEBUG JobSpy [(null)] - []
2017-04-24 12:11:47,617 [18] DEBUG JobSpy [(null)] - [PROC SQL;]
2017-04-24 12:11:47,617 [18] DEBUG JobSpy [(null)] - [ CREATE TABLE WORK.QUERY_F AS ]
2017-04-24 12:11:47,617 [18] DEBUG JobSpy [(null)] - [ SELECT t1.FYEAR, ]
2017-04-24 12:11:47,617 [18] DEBUG JobSpy [(null)] - [ t1.RE, ]
2017-04-24 12:11:47,617 [18] DEBUG JobSpy [(null)] - [ /* SUM_of_FLAG */]
2017-04-24 12:11:47,617 [18] DEBUG JobSpy [(null)] - [ (SUM(t1.FLAG)) FORMAT=11. AS SUM_of_FLAG, ]
2017-04-24 12:11:47,617 [18] DEBUG JobSpy [(null)] - [ /* Out of Hours */]
2017-04-24 12:11:47,617 [18] DEBUG JobSpy [(null)] - [ (Case When t1.TIME between '0900' and '1700' then '9 to 5' else 'Out of hours' End) AS ]
2017-04-24 12:11:47,617 [18] DEBUG JobSpy [(null)] - [ 'Out of Hours'n]
2017-04-24 12:11:47,632 [18] DEBUG JobSpy [(null)] - [ FROM H900.HE_1415 t1]
2017-04-24 12:11:47,632 [18] DEBUG JobSpy [(null)] - [ LEFT JOIN H9.ACATEGORY t2 ON (t1.CAT = t2.AE_ACATEGORY_CODE AND ]
2017-04-24 12:11:47,632 [18] DEBUG JobSpy [(null)] - [ (t2.IS_CURRENT = 1))]
2017-04-24 12:11:47,632 [18] DEBUG JobSpy [(null)] - [ LEFT JOIN H900.AGE_BANDS t3 ON (t1.AR_CALC = t3.AG AND (t3.AG_BAND = 'nary'))]
2017-04-24 12:11:47,632 [18] DEBUG JobSpy [(null)] - [ WHERE t3.AG < 5 AND t1.RE = '0F' AND ( t2.ADE = '1' OR ]
2017-04-24 12:11:47,632 [18] DEBUG JobSpy [(null)] - [ t2.AGORY_CODE = '9' )]
2017-04-24 12:11:47,632 [18] DEBUG JobSpy [(null)] - [ GROUP BY t1.FYEAR,]
2017-04-24 12:11:47,632 [18] DEBUG JobSpy [(null)] - [ t1.RE,]
2017-04-24 12:11:47,632 [18] DEBUG JobSpy [(null)] - [ (CALCULATED 'Out of Hours'n);]
2017-04-24 12:11:47,632 [18] DEBUG JobSpy [(null)] - [QUIT;]
2017-04-24 12:11:47,632 [18] DEBUG JobSpy [(null)] - []
2017-04-24 12:11:47,632 [18] DEBUG JobSpy [(null)] - [GOPTIONS NOACCESSIBLE;]
2017-04-24 12:11:47,632 [18] DEBUG JobSpy [(null)] - []
2017-04-24 12:11:47,632 [18] DEBUG JobSpy [(null)] - []
2017-04-24 12:11:47,632 [18] DEBUG JobSpy [(null)] - []
2017-04-24 12:11:47,632 [18] DEBUG JobSpy [(null)] - []
2017-04-24 12:11:47,632 [18] DEBUG JobSpy [(null)] - [%LET _CLIENTTASKLABEL=;]
2017-04-24 12:11:47,632 [18] DEBUG JobSpy [(null)] - [%LET _CLIENTPROCESSFLOWNAME=;]
2017-04-24 12:11:47,632 [18] DEBUG JobSpy [(null)] - [%LET _CLIENTPROJECTPATH=;]
2017-04-24 12:11:47,632 [18] DEBUG JobSpy [(null)] - [%LET _CLIENTPROJECTNAME=;]
2017-04-24 12:11:47,632 [18] DEBUG JobSpy [(null)] - []
2017-04-24 12:11:47,632 [18] DEBUG JobSpy [(null)] - [;*';*";*/;quit;run;]
2017-04-24 12:11:47,632 [18] DEBUG JobSpy [(null)] - [ODS _ALL_ CLOSE;]
2017-04-24 12:11:47,632 [18] DEBUG JobSpy [(null)] - []
2017-04-24 12:11:47,632 [18] DEBUG SAS.EG.JobManagement.WorkspaceJob [(null)] - (Id=1) OnExecuting() - setting up data structures
2017-04-24 12:11:47,632 [18] DEBUG SAS.EG.JobManagement.WorkspaceJob [(null)] - (Id=1) OnExecuting() - submitting code to server
2017-04-24 12:11:47,648 [18] DEBUG SAS.EG.JobManagement.Job [(null)] - (Id=1) OnStatusChanged() - entering
2017-04-24 12:11:47,648 [18] DEBUG SAS.EG.JobManagement.Job [(null)] - (Id=1) OnStatusChanged() - leaving
... View more