Event alert

Pravinsugi — Sun, 10 Dec 2023 15:51:10 GMT

i have three events like received message class.if you seee the pic,you will be seeing 3 event for each customer .each event have customerordernumber.i want to check for each and every customer I have all three event message in the splunk log.how to write splunk query for that.

Re: Event alert

gcusello — Fri, 08 Dec 2023 10:26:37 GMT

Hi @Pravinsugi,

let me understand:

for each customerOrderNumber, you have three Received message classes,
you want to check that's this is true fro each one,

is it correct?

At first, next time, please share your samples in text format to avoid to rewrite all of them.

Then I suppose that you already extracted the two fields customerOrderNumber and Received_message_class, otherwise you have to extract them, but to help you in this I need of your sample logs in text format.

Anyway, you should run something like this:

<your_search> | stats dc(Received_message_class) AS Received_message_class_count values(Received_message_class) AS Received_message_class BY customerOrderNumber | eval status=if(Received_message_class_cont=3,"OK","there are only the following Messages: ".Received_message_class | table customerOrderNumber status

Ciao.

Giuseppe

topic Re: Event alert in Alerting

Event alert

Re: Event alert