topic Re: Dynamic Alert from shown logs in Alerting

Dynamic Alert from shown logs

shraddhagrawal — Mon, 25 Mar 2024 09:09:34 GMT

Hi,

I need to find errors/exceptions which has been raised within a timestamp and as per the request_id field mentioned in the logs(with every row) , need to fetch relevant logs in splunk for that request_id and send this link to slack channel.

I am able to fetch all the errors/exception within timestamp and able to send to slack but I am not able to generate the relevant logs for the request_id mentioned with error/exception as it is dynamic in nature.

I am new to splunk so would like to understand, is this possible? if yes then could you please share relevant documentation so that I can understand it better.

Thank you so much.

Re: Dynamic Alert from shown logs

ITWhisperer — Mon, 25 Mar 2024 09:20:55 GMT

Since you have given your problem statement in generic terms, I will answer in the same manner. You could look to use the eventstats command to add / copy the exception indicator to all events with the corresponding request id. Then you can filter the event by whether the exception indicator is present.

Re: Dynamic Alert from shown logs

shraddhagrawal — Mon, 25 Mar 2024 09:33:44 GMT

Thank you, let me check.