topic Re: Extract common user who encounters different values for the same field over time in Splunk Search

Extract common user who encounters different values for the same field over time

BoGiulio — Thu, 21 Jun 2018 09:01:07 GMT

Hello, Splunk noob here. I'd like to find in my index users who encounters an error during a phase of a process but later, for the same phase, are able to succeed. So it would be something like this:

User=A phase="something" result=error 10:00 AM
User=A phase="something" result=success 10:05 AM

I'd like to be able to gather all of the users who face a similar situation.
Anyone can suggest a solution?

Thanks a lot in advance.

Re: Extract common user who encounters different values for the same field over time

niketn — Thu, 21 Jun 2018 11:33:58 GMT

@BoGiulio what if there is an error after success again? Is there supposed to be excluded?

Re: Extract common user who encounters different values for the same field over time

BoGiulio — Thu, 21 Jun 2018 13:14:17 GMT

@niketnilay for the data I'm focusing on there can't be a sequence success-error, only sometimes error-success; after the user has success for a specific phase, it goes to the next one. Thanks a lot for your time.

Re: Extract common user who encounters different values for the same field over time

somesoni2 — Thu, 21 Jun 2018 15:06:25 GMT

May be something like this would work.

your search
| stats latest(result) as latest values(result) as results by User phase
| where latest="success" AND isnotnull(mvfind(match(results,"error")))

Re: Extract common user who encounters different values for the same field over time

BoGiulio — Thu, 21 Jun 2018 15:49:50 GMT

@somesoni2 maybe I am doing some mistakes putting my real values instead of placeholders, but it doesn't seem to be working. Thanks a lot anyway!

Re: Extract common user who encounters different values for the same field over time

LxSenpai — Thu, 21 Jun 2018 16:10:49 GMT

Hey there, Looks like you need to add a "filter" that says "return all the events for this User A that has error and success for this period of time" .

Also there is "Alerts" that you could create which will give you basically alerts on such events.

Re: Extract common user who encounters different values for the same field over time

somesoni2 — Thu, 21 Jun 2018 16:22:52 GMT

Would you mind sharing the search you're trying with? Scrub anything sensitive. Did you get any error running above search OR just the output is not as expected?