Can you separate the statistics returned from a script?

Any ideas?  I am failing so far  :-)

It shouldn't be too difficult, but you'll need to code in the label names statically.  From my testing SAM doesn't play nice with dynamic labels:

For example:

# Use this...
print "Message.Label1: $message1";
print "Statistic.Label1: $statistic1";

# Not this...
print "Message.$label1: $message1";
print "Statistic.$label1: $statistic1";

Once you've made the changes you'll need to rerun the action that gathers the output before testing.

I have this in my script (below).  But how do I show this in my alert?  Multistatistic does not use the display names and is just dumps it all out....

while (<LOGFILE>) {
    my ($line) = $_;
    chomp($line);

    # Look for "ERROR" in the fourth whitespace delimited position
    ( $first, $second, $third, $fourth, $fifth, $sixth, $seventh, $eighth, $ninth, $remainder ) = split(/\s+/);
    foreach $value (@JobType) {
      if ( $value eq $first ) {
        $counter = 1;
        print "Statistic.1: $first\n";
        print "Message.1: $first\n";
        print "Statistic.2: 1\n";
        print "Message.2: $second\n";
        print "Statistic.3: 1\n";
        print "Message.3: $third\n";
        print "Statistic.4: 1\n";
        print "Message.4: $fourth\n";
        print "Statistic.5: 1\n";
        print "Message.5: $fifth\n";
        print "Statistic.6: 1\n";
        print "Message.6: $sixth\n";
        print "Statistic.7: 1\n";
        print "Message.7: $seventh\n";
        print "Statistic.8: 1\n";
        print "Message.8: $eighth\n";
        print "Statistic.9: 1\n";
        print "Message.9: $ninth\n";
        print "Statistic.10: 1\n";
        print "Message.10: $remainder\n";

The multi value statistics in that script will be labelled 1,2,3..10.

I'm not really sure what the above script is trying to do.  The comment indicates that you are testing for "ERROR" at the fourth position, but the test never compares against the fourth position.  Also, with the script written that way it will trigger the first time it hits an error message which could cause problems if the log file is appended.

As far as the testing goes, I'd recommend using regex... This is really, really easy if you are only concerned about the word "ERROR" appearing anywhere in the line.  It looks like you are splitting the line so that you can use the eq operation for comparison.

while (<LOGFILE>)
{
     if ( m/ERROR/i )    # Check for the word error anywhere on the line,
                         # Case insensitive
     {
          print "Statistic.LogError: 1\n"; # Since statistic data is irrelevant always return 1
                                           # when an error is found. Threshold should be => 1
          print "Message.LogError: $_\n"; # Return the full line containing the error message
          close LOGFILE;
          exit(0);
     }
}
close LOGFILE;
print "Statistic.Logerror: 0\n"; # Since statistical data is irrelevant always return 0
                                 # when no error is found. Threshold should be => 1
print "Message.Logerror: No Errors Found\n"; # Return basic all clear message
exit(0);

Again, the above assumes that the position of ERROR is unimportant.  If you can post up the full script it will help us figure out what exactly is going on... some things like the contents of @JobType or the meaning of $counter will be helpful in clearing up your script.

First, let me thank you for looking at this for me...  I REALLLY APPRECIATE it.

I'm adding the whole script below.  I didn't write it, one of our overworked UNIX guys did it for me and I just manipulated it a bit for the 10 messages.

It looks at a log file looking for the first field (Event Number) to equal 101, 102, 111, or 115.  then it is supposed to take certain fields in the log and forward that as a super high priority to the operators so that they can restart that "job"

This is very important because if a job is lost, wal-mart (or other grocery store) may not recieve thier order of thousands of pounds of fresh chicken.

Tivoli has been handling this with an agent that watches the log, but now we are replacing that with Orion....

This is what my alert email looks like:

(testing production log, please compare to Tivoli)
Component name:TWS Log Error Checker:

EventNumber:101, WorkStation:PE100800, WorkStationID:0AAAAAAAAAAAFEGS, JobName:CORUAFWP_PPPI_MR42_D, JobRunLocation:PE100800, JobNumber:2359474, JobStatus:5, JobName2:CORUAFWP_PPPI_MR42_D, TWSserver:twspr, RestOfData:/\040-job\040CORUAFWP_PPPI_MR42_D\040-user\040UDG2513\040-i\04008180500\040-c\040c

EventNumber:
101 = Job abend
102 = Job Failed
111 = Job Failed
115 = Job in STUCK Status

Here is the script:

#!/usr/bin/perl

@JobType = (
    "101",         "102",
    "111",           "115"
);

my $LOGFILE = "/tws/pr/event.log";

open( LOGFILE, "</tws/pr/event.log" )
  or die("Could not open log file.");

# what was the last position read.  Open POSITION for reading
open( POSITION, "</scripts/Orion/current.txt" )
  or die("Could not open Position.");
while (<POSITION>) {
    $current = $_;
    chomp($current);
}
close(POSITION);

# Open POSITION for update
open( POSITION, ">/scripts/Orion/current.txt" )
  or die("Could not open Position.");

# Check if log file has been truncated or reduced in size.  If so move pointer to the top
$filesize = -s $LOGFILE;
if ( $filesize < $current ) {

    #    print "Current size $filesize less than $current.  Point to top\n";
    $current = 0;
}

seek( LOGFILE, $current, 0 )
  or die "Couldn't seek to the last position recorded: $!\n";

$counter = 0;

while (<LOGFILE>) {
    my ($line) = $_;
    chomp($line);

    # Look for "ERROR" in the fourth whitespace delimited position
    ( $first, $second, $third, $fourth, $fifth, $sixth, $seventh, $eighth, $ninth, $remainder ) = split(/\s+/);
    foreach $value (@JobType) {
      if ( $value eq $first ) {
        $counter = 1;
        print "Statistic.1: $first\n";
        print "Message.1: $first\n";
        print "Statistic.2: 1\n";
        print "Message.2: $second\n";
        print "Statistic.3: 1\n";
        print "Message.3: $third\n";
        print "Statistic.4: 1\n";
        print "Message.4: $fourth\n";
        print "Statistic.5: 1\n";
        print "Message.5: $fifth\n";
        print "Statistic.6: 1\n";
        print "Message.6: $sixth\n";
        print "Statistic.7: 1\n";
        print "Message.7: $seventh\n";
        print "Statistic.8: 1\n";
        print "Message.8: $eighth\n";
        print "Statistic.9: 1\n";
        print "Message.9: $ninth\n";
        print "Statistic.10: 1\n";
        print "Message.10: $remainder\n";
       }
    }
}
    if ( $counter == 0 ) {
      print "Statistic.1:0\n";
      print "Message.1:0\n";
      print "Statistic.2:0\n";
      print "Message.2:0\n";
    }

# Save the current location for the next run
$pos = tell(LOGFILE);
print POSITION $pos;

close(POSITION);
close(LOGFILE);

exit(0);

That definitely helps to clarify some things.

We haven't gone full production with 4.2+ yet (hope to jump to SAM 5 in the next few weeks ), but I think that part of the problem is the difference in output when an error is found (10 Outputs) and when it isn't (2 Outputs). Without making too many modifications to your script TMTOWTDI! I'd say try the following change:

while (<LOGFILE>) {
    my ($line) = $_;
    chomp($line);
    # Look for "ERROR" in the fourth whitespace delimited position
    ( $first, $second, $third, $fourth, $fifth, $sixth, $seventh, $eighth, $ninth, $remainder ) = split(/\s+/);
    foreach $value (@JobType) {
      if ( $value eq $first ) {
        $counter = 1;
        print "Statistic.1: $first\n";
        print "Message.1: $_\n";

       }
    }
}
    if ( $counter == 0 ) {
      print "Statistic.1:0\n";
      print "Message.1:0\n";     
   }

This will print the error number as the statistic and the full line as the Message.  If there was individual information in the other fields that you wanted to track on their own then include them one by one (similar to how you had it originally), but be sure to include the same amount in both places.