topic Re: search for a string in field , if not there then trigger alert with remaining data in fields in Splunk Search

search for a string in field , if not there then trigger alert with remaining data in fields

kirrusk — Wed, 29 Sep 2021 06:40:39 GMT

Hi,

I want to check for a string in the field, but if the string is not found in the field then need to print the remaining data. (last 15 mins data)

for example,

Field1 Field2
9/2/10 successful
9/2/10 creating the file
9/2/10 created

from the above table, I want to check the Field2 for the last 15mins for string "successful", if no string is found in Field2 with "successful", Then need to trigger an alert with the remaining data like below.

Field1 Field2
9/2/10 creating the file
9/2/10 created

is this possbile in splunk.

Re: search for a string in field , if not there then trigger alert with remaining data in fields

gcusello — Wed, 29 Sep 2021 06:58:32 GMT

Hi @kirrusk,

let me understand:

your need is a two phases check:
- check if in Field2 there's the string "Successful",
- then display the values of the Field2 field below "Successful"

Is this correct?

If this is your need, please try something like this:

index=your_index ield2=* | transaction startswith="Successful" | mvexpand field2 | search field2!="Successful" | table _time field2

if the number of events after "Successful" is fixes (e.g. always 2), you could be more precise adding an option to the transaction command "maxevents=2".

Ciao.

Giuseppe

Re: search for a string in field , if not there then trigger alert with remaining data in fields

kirrusk — Wed, 29 Sep 2021 07:30:04 GMT

@gcusello

@gcusello
Thank you, but my intention is to trigger an alert with the remaining data in Field2.
if there is no string("Successful") at all in Field2.

sample alert,

no log found for successful, Please find logs

Field1 Field2
9/2/10 creating the file
9/2/10 created

Re: search for a string in field , if not there then trigger alert with remaining data in fields

gcusello — Wed, 29 Sep 2021 07:48:25 GMT

Hi @kirrusk,

ok, please try something like this:

in this way, you check if in your logs there's the "Successful" string:

if present, there's no result in the search,
if not present, it displays all the field2 values.

Ciao.

Giuseppe

Re: search for a string in field , if not there then trigger alert with remaining data in fields

ITWhisperer — Wed, 29 Sep 2021 08:57:52 GMT

index=your_index Field2=* | eval check=if(Field2="Successful","Yes",null()) | eventstats values(check) AS check | where isnull(check)