Hi I have events coming from the servers. here we have some sample data.
2017-03-29 13:57:09.892 [WMQJCAResourceAdapter : 1424] [INFO ] [DCN 0201708802519120C] SplunkLog - DCN=0201708802519120C, CorrelationID=000970348003699784622353, TransactionTimestamp=2017-03-29 13:57:08.135, GroupNumber =00064939G, ServiceLinecount=3, SectionNumber=0009, CorporateEntityCode=TX1, ClaimType=0, VendorName=VERSCEND, VendorCode=CVP, TransactionCode=RSPUtilizationAmount=0, Department=213, CVPOutcomeCode=G, CVPClaimStatusCode=VA
2017-03-29 13:57:09.285 [WMQJCAResourceAdapter : 2216] [INFO ] [DCN 0201708802519120C] SplunkLog - DCN=0201708802519120C, CorrelationID=000970348003699784622353, TransactionTimestamp=2017-03-29 13:57:09.285, GroupNumber =00064939G, ServiceLinecount=3, SectionNumber=0009, CorporateEntityCode=TX1, ClaimType=0, VendorName=VERSCEND, VendorCode=CVP, TransactionCode=ACK, OutCome=C, Messagetext=ACCEPTED, CVPOutcomeCode=O, Department=213,
2017-03-29 13:57:07.379 [WMQJCAResourceAdapter : 2229] [INFO ] [DCN 0201708802519120C] SplunkLog - DCN=0201708802519120C, CorrelationID=000970348003699784622353, TransactionTimestamp=2017-03-29 13:57:07.379, GroupNumber =00064939G, ServiceLinecount=3, SectionNumber=0009, CorporateEntityCode=TX1, ClaimType=0, VendorName=VERSCEND, VendorCode=CVP, TransactionCode=REQ, Department=213, CVPOutcomeCode=O, CVPClaimStatusCode=VA,
here correlationId is unique key here
I want to display these values in a single table but here cvpoutcomecode and cvpclaimstatuscode will vary in these messages but sometimes not. I want to display those values in the table from which message is coming from either Req,ack,rsp.
Please need help ....thanks in advance
... View more