Hi ,
I am trying to find the list of ids that fail from my logs.
Say I have
2023-11-14T10:30:30,118 INFO Operation failed
.....
......
2023-11-14T10:30:40,118 INFO Operation ID ABCD
.............
2023-11-14T10:35:25,118 INFO Operation success
.....
......
2023-11-14T10:35:30,118 INFO Operation id 1234
''''''
I am trying to get the information as
Time stamp | Status | ID |
2023-11-14T10:30:30 | failed | ABCD |
2023-11-14T10:30:30 | Success | 1234 |
I appreciate any help
Thanks
In case of success the info is
http-nio-8080-exec-14 nteg 2023-11-14T10:33:30,062 INFO REQEST XML
http-nio-8080-exec-14 nteg 2023-11-14T10:33:30,062 INFO Operation started
http-nio-8080-exec-14 nteg 2023-11-14T10:33:30,118 INFO Operation Success
http-nio-8080-exec-14 nteg 2023-11-14T10:33:30,118 INFO request processed
http-nio-8080-exec-14 nteg 2023-11-14T10:33:30,118 INFO Processed {1234-6789}
Copy/Paste this example into your search window
| makeresults
| eval _raw="http-nio-8080-exec-6 nteg 2023-11-14T10:30:30,062 INFO REQEST XML
http-nio-8080-exec-6 nteg 2023-11-14T10:30:30,062 INFO Operation started
http-nio-8080-exec-6 nteg 2023-11-14T10:30:30,112 ERROR Operation error
.WsdlFault: Failed to process
CALL STACk
http-nio-8080-exec-6 nteg 2023-11-14T10:30:30,118 INFO Operation failed
http-nio-8080-exec-6 nteg 2023-11-14T10:30:30,118 INFO request processed
http-nio-8080-exec-6 nteg 2023-11-14T10:30:30,118 ERROR exception thrown regarding {ABCDEFGH-IJKL}
http-nio-8080-exec-6 nteg 2023-11-14T10:30:30,118 ERROR exception thrown regarding {ABCDEFGH-IJKL}
http-nio-8080-exec-14 nteg 2023-11-14T10:33:30,062 INFO REQEST XML
http-nio-8080-exec-14 nteg 2023-11-14T10:33:30,062 INFO Operation started
http-nio-8080-exec-14 nteg 2023-11-14T10:33:30,118 INFO Operation Success
http-nio-8080-exec-14 nteg 2023-11-14T10:33:30,118 INFO request processed
http-nio-8080-exec-14 nteg 2023-11-14T10:33:30,118 INFO Processed {1234-6789}"
| multikv noheader=t
| eval _raw=Column_1.if(len(Column_2)>0,",".Column_2,"")
| table _raw
| rex "(?<t>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2},\d{3})"
| eval _time=strptime(t, "%FT%T,%Q")
``` Your data set up above ```
| rex "http-nio-8080-exec-(?<id>\d+).* (?<status>INFO|ERROR) (?<message>.*)"
| rex field=message "\{(?<op_id>\w+-\w+)"
| eval status=case(message="Operation failed", "Failed", message="Operation Success", "Success", true(), null())
| stats min(eval(if(message="Operation started", _time, null()))) as Op_Started values(op_id) as op_id values(status) as status by id
It takes your example data and assumes the first part is some kind of thread id and then does some extractions to join the data together.
If that thread id can occur more than once in your search range, then this won't work
Thanks @bowesmana I appreciate your help !!!!
Thanks @bowesmana , for looking into this.
Good point that Success/failed message relates to specific id or not , that is why I am trying to map to the time stamp of success/fail to that processed id and as well as filter to a host to compare.
the actual log info is
http-nio-8080-exec-6 nteg 2023-11-14T10:30:30,062 INFO REQEST XML
http-nio-8080-exec-6 nteg 2023-11-14T10:30:30,062 INFO Operation started
http-nio-8080-exec-6 nteg 2023-11-14T10:30:30,112 ERROR Operation error
.WsdlFault: Failed to process
CALL STACk
http-nio-8080-exec-6 nteg 2023-11-14T10:30:30,118 INFO Operation failed
http-nio-8080-exec-6 nteg 2023-11-14T10:30:30,118 INFO request processed
http-nio-8080-exec-6 nteg 2023-11-14T10:30:30,118 ERROR exception thrown regarding {ABCDEFGH-IJKL}
http-nio-8080-exec-6 nteg 2023-11-14T10:30:30,118 ERROR exception thrown regarding {ABCDEFGH-IJKL}
Thanks
Does this mean anything
http-nio-8080-exec-6
is that some kind of thread id?
How do you know that the success/failed message relates to a specific id?
In your example, the status comes before the message id event. What you have more than one event id coming and they are out of sync?