Splunk - GPP Splunk

============================================================================================================================================================
============================================================================================================================================================

Collection Team Team - Request Batch 1

============================================================================================================================================================
============================================================================================================================================================

Search Name: PF_LodeRunner_SI_GetDownloadedFileCount

ORIGINAL QUERY:

index=applog_pf "Process the element with index" | stats count as DownloadedFileCount | eval Title="ProcessTheElement" | table Title, DownloadedFileCount
| append [ search index=applog_pf "finish extract data" | stats count as DownloadedFileCount | eval Title="FinishExtractData" | table Title, DownloadedFileCount ]
| append [ search index=applog_pf "finish extract master data" | stats count as DownloadedFileCount | eval Title="FinishExtractMasterData" | table Title, DownloadedFileCount ]
| append [ search index=applog_pf "Save file" | stats count as DownloadedFileCount | eval Title="SaveFile" | table Title, DownloadedFileCount ]

UPDATED QUERY:

index=applog_pf "Process the element with index" | stats count as DownloadedFileCount | eval Title="ProcessTheElement"
| append [ search index=applog_pf "finish extract data" | stats count as DownloadedFileCount | eval Title="FinishExtractData" ]
| append [ search index=applog_pf "finish extract master data" | stats count as DownloadedFileCount | eval Title="FinishExtractMasterData" ]
| append [ search index=applog_pf "Save file" | stats count as DownloadedFileCount | eval Title="SaveFile" ]
| table Title, DownloadedFileCount

UPDATED QUERY FOR SUMMARY INDEXING:

index=applog_pf "Process the element with index" | sistats count as DownloadedFileCount | eval Title="ProcessTheElement"
| append [ search index=applog_pf "finish extract data" | sistats count as DownloadedFileCount | eval Title="FinishExtractData" ]
| append [ search index=applog_pf "finish extract master data" | sistats count as DownloadedFileCount | eval Title="FinishExtractMasterData" ]
| append [ search index=applog_pf "Save file" | sistats count as DownloadedFileCount | eval Title="SaveFile" ]

QUERY AGAINST SUMMARY INDEX:

index=applog_gpp_summary search_name=PF_LodeRunner_SI_GetDownloadedFileCount | stats count as DownloadedFileCount by Title

 

Search Name: PF_LodeRunner_SI_GetVisitWebPageCount

ORIGINAL QUERY:

index=applog_pf "click completed!" | stats count as VisitFileCount | eval Title="ClickCompleted" | table Title, VisitFileCount
| append [ search index=applog_pf "Change Combo box completed!" | stats count as VisitFileCount | eval Title="ChangeComboBoxCompleted" | table Title, VisitFileCount ]
| append [ search index=applog_pf "navigate completed!" | stats count as VisitFileCount | eval Title="NavigateCompleted" | table Title, VisitFileCount ]
| append [ search index=applog_pf "Save file" | stats count as VisitFileCount | eval Title="SaveFile" | table Title, VisitFileCount ]
| append [ search index=applog_pf "Process the element with index" | stats count as VisitFileCount | eval Title="ProcessTheElement" | table Title, VisitFileCount ]

UPDATED QUERY:

index=applog_pf "click completed!" | stats count as VisitFileCount | eval Title="ClickCompleted"
| append [ search index=applog_pf "Change Combo box completed!" | stats count as VisitFileCount | eval Title="ChangeComboBoxCompleted" ]
| append [ search index=applog_pf "navigate completed!" | stats count as VisitFileCount | eval Title="NavigateCompleted" ]
| append [ search index=applog_pf "Save file" | stats count as VisitFileCount | eval Title="SaveFile" ]
| append [ search index=applog_pf "Process the element with index" | stats count as VisitFileCount | eval Title="ProcessTheElement" ]
| table Title, VisitFileCount

UPDATED QUERY FOR SUMMARY INDEXING:

index=applog_pf "click completed!" | sistats count as VisitFileCount | eval Title="ClickCompleted"
| append [ search index=applog_pf "Change Combo box completed!" | sistats count as VisitFileCount | eval Title="ChangeComboBoxCompleted" ]
| append [ search index=applog_pf "navigate completed!" | sistats count as VisitFileCount | eval Title="NavigateCompleted" ]
| append [ search index=applog_pf "Save file" | sistats count as VisitFileCount | eval Title="SaveFile" ]
| append [ search index=applog_pf "Process the element with index" | sistats count as VisitFileCount | eval Title="ProcessTheElement" ]

QUERY AGAINST SUMMARY INDEX:

index=applog_gpp_summary search_name=PF_LodeRunner_SI_GetVisitWebPageCount | stats count as VisitFileCount by Title

============================================================================================================================================================
============================================================================================================================================================

Collection Team Team - Request Batch 2

============================================================================================================================================================
============================================================================================================================================================

Search Name: Downloader_SI_GetSuccessfulDownloadedFileCount

ORIGINAL QUERY:

index=gpp "processname=downloader" "File Downloaded Successfully" | stats count(FileId) as FileCountOfSuccessfulDownload by ProcessName | table ProcessName, FileCountOfSuccessfulDownload
| append [ search index=gpp "processname=downloader" "File Downloaded Successfully" | stats count(FileId) as FileCountOfSuccessfulDownload | table ProcessName, FileCountOfSuccessfulDownload ]

UPDATED QUERY:

index=gpp ProcessName=downloader* "File Downloaded Successfully" | stats count(FileId) as FileCountOfSuccessfulDownload by ProcessName | table ProcessName, FileCountOfSuccessfulDownload | addcoltotals labelfield=ProcessName label=ALL

UPDATED QUERY FOR SUMMARY INDEXING:

index=gpp ProcessName=downloader* "File Downloaded Successfully" | sistats count(FileId) as FileCountOfSuccessfulDownload by ProcessName

QUERY AGAINST SUMMARY INDEX:

index=applog_gpp_summary search_name=Downloader_SI_GetSuccessfulDownloadedFileCount | stats count(FileId) as FileCountOfSuccessfulDownload by ProcessName | table ProcessName, FileCountOfSuccessfulDownload | addcoltotals labelfield=ProcessName label=ALL

 

Search Name: GPP_Downloader_SI_GetFailedDownloadedFileCount

ORIGINAL QUERY:

index=gpp "processname=downloader" "Download file unsuccessfully" | stats count as FileCountOfFailedDownload BY ProcessName | table ProcessName, FileCountOfFailedDownload
| append [ search index=gpp "processname=downloader" "Download file unsuccessfully" | stats count as FileCountOfFailedDownload | table ProcessName, FileCountOfFailedDownload ]

UPDATED QUERY:

index=gpp ProcessName=downloader* "Download file unsuccessfully" | stats count as FileCountOfFailedDownload BY ProcessName | table ProcessName, FileCountOfFailedDownload | addcoltotals labelfield=ProcessName label=ALL

UPDATED QUERY FOR SUMMARY INDEXING:

index=gpp ProcessName=downloader* "Download file unsuccessfully" | sistats count as FileCountOfFailedDownload BY ProcessName

QUERY AGAINST SUMMARY INDEX:

index=applog_gpp_summary search_name=GPP_Downloader_SI_GetFailedDownloadedFileCount | stats count as FileCountOfFailedDownload BY ProcessName | table ProcessName, FileCountOfFailedDownload | addcoltotals labelfield=ProcessName label=ALL

 

Search Name: GPP_Downloader_SW_GetFailedFileSourceTrackingCount

ORIGINAL QUERY:

index=gpp "processname=downloader" "Error occurs when AddFileSourceTracking" | stats count(FileId) as ErrorCountOfFailedAddFileSourceTracking by ProcessName | table ProcessName, ErrorCountOfFailedAddFileSourceTracking
| append [ search index=gpp "processname=downloader" "Error occurs when AddFileSourceTracking" | stats count(FileId) as ErrorCountOfFailedAddFileSourceTracking | table ProcessName, ErrorCountOfFailedAddFileSourceTracking ]

UPDATED QUERY:

index=gpp ProcessName=downloader* "Error occurs when AddFileSourceTracking" | stats count(FileId) as ErrorCountOfFailedAddFileSourceTracking by ProcessName | table ProcessName, ErrorCountOfFailedAddFileSourceTracking | addcoltotals labelfield=ProcessName label=ALL

UPDATED QUERY FOR SUMMARY INDEXING:

index=gpp ProcessName=downloader* "Error occurs when AddFileSourceTracking" | sistats count(FileId) as ErrorCountOfFailedAddFileSourceTracking by ProcessName

QUERY AGAINST SUMMARY INDEX:

index=applog_gpp_summary search_name=GPP_Downloader_SW_GetFailedFileSourceTrackingCount | stats count(FileId) as ErrorCountOfFailedAddFileSourceTracking by ProcessName | table ProcessName, ErrorCountOfFailedAddFileSourceTracking | addcoltotals labelfield=ProcessName label=ALL

 

Search Name: GPP_Downloader_SW_GetFailedMatchedFileNameListCount

ORIGINAL QUERY:

index=gpp "processname=downloader" "Error occurs when GetMatchedFileNameList" | stats count as ErrorCountOfGetMatchedFileFailed by ProcessName | table ProcessName, ErrorCountOfGetMatchedFileFailed
| append [ search index=gpp "processname=downloader" "Error occurs when GetMatchedFileNameList" | stats count as ErrorCountOfGetMatchedFileFailed | table ProcessName, ErrorCountOfGetMatchedFileFailed ]

UPDATED QUERY:

index=gpp ProcessName=downloader* "Error occurs when GetMatchedFileNameList" | stats count as ErrorCountOfGetMatchedFileFailed by ProcessName | table ProcessName, ErrorCountOfGetMatchedFileFailed | addcoltotals labelfield=ProcessName label=ALL

UPDATED QUERY FOR SUMMARY INDEXING:

index=gpp ProcessName=downloader* "Error occurs when GetMatchedFileNameList" | sistats count as ErrorCountOfGetMatchedFileFailed by ProcessName

QUERY AGAINST SUMMARY INDEX:

index=applog_gpp_summary search_name=GPP_Downloader_SW_GetFailedMatchedFileNameListCount | stats count as ErrorCountOfGetMatchedFileFailed by ProcessName | table ProcessName, ErrorCountOfGetMatchedFileFailed | addcoltotals labelfield=ProcessName label=ALL

 

转载于:https://www.cnblogs.com/flysun0311/archive/2012/09/20/2694774.html