topic Re: And condition in Alerting

And condition

Pravinsugi — Sun, 03 Dec 2023 14:01:40 GMT

I have below message in the splunk log

Ex : s1 event has been received for customer 15778

S2 event has been received for customer 15778

S3 event has been received for customer 15778

I want to check all S1,S2,S3 event has been received message present in the particular customer.i used AND condition but not able to achieve.plesse help me on this.

As per my scenario,if i have 1 lakhs customer, i want to check for all 3 events has been received mesage is present in the splunk log for one particular customer.if not present all 3 mesage i need to set up alert.

Re: And condition

richgalloway — Sun, 03 Dec 2023 15:04:43 GMT

The AND operator works within a single event. To combine multiple events you need to use an aggregating command. Assuming the customer number has been extracted into a field called "customer" then this will trigger an alert if any customer does not have all three events.

<<some search for S1, S2, and S3>> | stats count by customer | where count < 3

Re: And condition

ITWhisperer — Sun, 03 Dec 2023 15:09:44 GMT

Assuming customer and event have already been extracted

| stats values(event) as events by customer | where NOT (events = "s1" AND events = "s2" AND events = "s3")

Re: And condition

Pravinsugi — Sun, 03 Dec 2023 15:22:06 GMT

How to extract customer number from the event .pls advise

Re: And condition

Pravinsugi — Sun, 03 Dec 2023 15:22:40 GMT

How to extract customer number ?

Re: And condition

ITWhisperer — Sun, 03 Dec 2023 15:24:17 GMT

| rex "customer (?<customer>\d+)"

Re: And condition

Pravinsugi — Sun, 03 Dec 2023 15:29:18 GMT

I have below query .how to include into result query.pls advise

Need to include this one into result query

| stats values(event) as events by customer | where NOT (events = "s1" AND events = "s2" AND events = "s3")

Result query:

(index=1 sourcetype="abc" "s1 event received" and "s2 event received" and "s3 event received") OR (index=2 sourcetype="xyz" "created") | rex "(?<e_type>s.) event received for (?<customer>\d+)" | rex "(?<created>created) for (?<customer>\d+)" | stats max(eval(if(e_type="s3",_time, null()))) as last_e_type max(eval(if(created="created", _time, null()))) as created_time dc(e_type) as e_types values(created) as created by customer | addinfo | where e_types=3 AND (created_time-last_e_type > 300 OR (isnull(created_time) AND info_max_time - last_e_type > 300)

Re: And condition

ITWhisperer — Sun, 03 Dec 2023 15:37:13 GMT

It depends on what you are trying to do since this search seems to be the opposite of what you had previously said you were trying to do.