topic RE: Splunk with BP log in Digital Exchange

Splunk with BP log

HazemFarajallah — Tue, 13 Aug 2019 12:09:00 GMT

Hello everyone,

I'm trying to use Splunk to monitor all BP process, can see every process and stage and so on,

but can't filter where is the process terminated or not. (i can see when is terminate ) ,

can anyone do small tips on how to show completed or terminated process on the Splunk?

------------------------------
Hazem Farajallah
RPA-developer
e-on
Europe/Stockholm
------------------------------

RE: Splunk with BP log

GopalBhaire — Tue, 13 Aug 2019 14:11:00 GMT

Convert StartDate to time then sort SessionNumber on converted time & finally use case where StageType=End is Completed & Result containing ERROR is Terminated.and StageType=Undefined is Stopped.

------------------------------
Gopal Bhaire
Analyst
Accenture
------------------------------

RE: Splunk with BP log

HazemFarajallah — Wed, 14 Aug 2019 11:00:00 GMT

Thanks for sharing, i kind of new to splunk
i have this data from BP log

currprocessid: 1c808a33-3c5a-4c88-a189-1c2b07968d01
   currprocessname: Logout
   currprocesstype: 0
   eventId: endProcess
   mainprocessid: 1c808a33-3c5a-4c88-a189-1c2b07968d01
   mainprocessname: Logout
   pageid: 00000000-0000-0000-0000-000000000000
   pagename: Main Page
   resourceName: HP20062703
   sessionNumber: 2677
   sessionid: 96f9421d-1b82-4e89-a5d3-7824d50708b8
   stageid: 1e575b0c-7b9f-4c63-a376-8582dd8f27f2
   stagename: End
   when: 2019-08-14T10:54:41.6449175Z

what I'm trying to get in a table is when started and finished, resourse name, process name, and status.

i can find when is every process started but cant compind with Compeleted or terminated .

if you have tips how to query them it will be great.

Thanks in advance

------------------------------
Hazem Farajallah
RPA-developer
e-on
Europe/Stockholm
------------------------------

RE: Splunk with BP log

GopalBhaire — Wed, 14 Aug 2019 16:33:00 GMT

You're using v6.4, much less info is sent than by Data Gateways, also I don't have Splunk installed right now.

But it has to be something like (the query below might not work, but let me know the result)

source="BP" | eval t = when | eval time=strptime(t,"%Y-%m-%dT%H:%M:%S.%Q%Z")| dedup 1 sessioNumber sortby -time | eval Status=case(eventId="endProcess", "Completed")| table mainprocessname, eventId , Status

You can terminate a process and examine the log than add it to case above (would be helpful if you paste that event here). Basically it's examining the last event of a session.

------------------------------
Gopal Bhaire
Analyst
Accenture
------------------------------

RE: Splunk with BP log

HazemFarajallah — Thu, 15 Aug 2019 08:29:00 GMT

Hello

thanks, it works great, what do you think is best to find the running ones (compare time on the same sessionid?)

------------------------------
Hazem Farajallah
RPA-developer
e-on
Europe/Stockholm
------------------------------