HI ,
I'm trying to create a Splunk alert to generate an email based on job failures. My SPL still retrieves records beyond 24 hours even after filtering them, I see redundant records in my alert. My alert should check for any failures and report them as soon as they happen. Not sure where am I going wrong.
Here is my search:
index=main source=Datameer sourcetype=job_execution Hadoop_Properties=*mapreduce* Job_Status = Error |dedup Job_Name sortby -Start_time |fields Job_Name,Artifact,Triggered_By,Artifact_Owner,Job_Execution_Id,Folder_Path ,Start_time,Stop_time,Job_Exception,Parent_folder,Root_folder,Branch_folder,Folder_name,Job_Status | eval Folder = Root_folder."/".Branch_folder."/".Folder_name |
eval Url="https://datameer.homeawaycorp.com/admin/job/".Job_Execution_Id |
Table Job_Name,Job_Status,Url,Folder,Artifact,Triggered_By,Artifact_Owner,Start_time,Stop_time ,Job_Status,Job_Exception
↧