topic find NOCLOSESESSION in logs daily in Splunk Search

find NOCLOSESESSION in logs daily

indeed_2000 — Wed, 13 Oct 2021 14:04:29 GMT

Hi
I have two field on my logfile <servername> <CLOSESESSION> need to know when CLOSESESSION is 0 each day by servername.
everyday I expect CLOSESESSION appear on my server logs, if one or more server has no CLOSESESSION it means something going wrong.

here is the spl:
index="my_index"
| rex field=source "(?<servername>\w+)."
| rex "CLOSESESSION\:\s+(?<CLOSESESSION>\w+)"

| table _time servername CLOSESESSION

Expected output:

Servername cause

Server10 NOCLOSESESSION

Server15 NOCLOSESESSION

any idea?

Thanks,

Re: find NOCLOSESESSION in logs daily

somesoni2 — Wed, 13 Oct 2021 14:46:17 GMT

Try this

index="my_index" | rex field=source "(?<servername>\w+)." | rex "CLOSESESSION\:\s+(?<CLOSESESSION>\w+)" | stats dc(CLOSESESSION) as CLOSESESSIONs by servername | where CLOSESESSIONs=0

Re: find NOCLOSESESSION in logs daily

ITWhisperer — Wed, 13 Oct 2021 14:49:35 GMT

Would something like this work for you?

Re: find NOCLOSESESSION in logs daily

indeed_2000 — Wed, 13 Oct 2021 15:41:11 GMT

not work, here is the log:

23:54:00.957 app server 1 module: CLOSESESSION

23:54:00.958 app server 3 module: CLOSESESSION

23:54:00.959 app server 4 module: CLOSESESSION

Expected output:

Servername cause

Server2 NOCLOSESESSION

Re: find NOCLOSESESSION in logs daily

indeed_2000 — Wed, 13 Oct 2021 15:42:16 GMT

not work, here is the log:

23:54:00.957 app server 1 module: CLOSESESSION

23:54:00.958 app server 3 module: CLOSESESSION

23:54:00.959 app server 4 module: CLOSESESSION

Expected output:

Servername cause

Server2 NOCLOSESESSION

Re: find NOCLOSESESSION in logs daily

ITWhisperer — Wed, 13 Oct 2021 15:48:20 GMT

If those are your logs, the issue may be with the rex - try something like this

| rex "\:\s+(?<CLOSESESSION>CLOSESESSION)"

Re: find NOCLOSESESSION in logs daily

indeed_2000 — Wed, 13 Oct 2021 17:46:26 GMT

still have issue, i think need two search here, first extract all server names from file name that exist in path from metadata for faster result, then in second query check which one has not CLOSESESSION

somthing like this:

1- list of all log files exist (per server)
| metadata type=sources index=my_index | table source

2-filter just lines have CLOSESESSION
index="my_index" | search CLOSESESSION
| rex extracted server names of field "source" from STEP 1
| rex "\:\s+(?<CLOSESESSION>CLOSESESSION)" |
| fillnull value="NOCLOSESESSION" CLOSESESSION
| bin _time span=1d
| stats values(CLOSESESSION) as CLOSESESSION by _time servername
| eval CLOSESESSION=mvjoin(CLOSESESSION,"")
| where CLOSESESSION="NOCLOSESESSION"

here is the logs:

23:54:00.957 app server 1 module: CLOSESESSION

23:54:00.958 app server 3 module: CLOSESESSION

23:54:00.959 app server 4 module: CLOSESESSION

Expected output step 1:

servernames

server 1

server 2

server 3

server 4

Expected output step 2:

Servername cause

Server2 NOCLOSESESSION

Re: find NOCLOSESESSION in logs daily

somesoni2 — Wed, 13 Oct 2021 18:39:39 GMT

You would basically need a lookup table file with all your server names (say lookup table file name will be servers.csv with column servername) . Once you've this setup, you can run something like this

Re: find NOCLOSESESSION in logs daily

indeed_2000 — Wed, 13 Oct 2021 21:59:48 GMT

is it possible without csv file?

Re: find NOCLOSESESSION in logs daily

indeed_2000 — Fri, 15 Oct 2021 09:25:53 GMT

after several try find solution