How to find the records based on another search but each happened afterwards

shancao — Tue, 22 Mar 2022 04:26:38 GMT

Hi, I would like to implement some splunk alert to check if there's any special event that happened after a certain event, all the events are grouped by the same request-id, wonder if you could help on this, thanks

queryA - index=app class=ClassA conditionA=aVal | fields rid, _ time | table rid, _time, each result (rid, _time) is unique

queryB - index=app class=ClassB conditionB=bVal rid=queryA.rid and _time > queryA._time

I would like to get the alert if queryB has a result.

If it is represented as a SQL, it would be like this

select field1, fiedl2 .... from queryB as B,
(select id, _time from queryA where afield1=someval and afield2=val2) as A
where B.id=A.id and B._time > A._time

Any help would be greatly appreciated, thanks

Re: How to find the records based on another search but each happened afterwards

VatsalJagani — Tue, 22 Mar 2022 05:50:53 GMT

You can try something like this:

index=app ((class=ClassA conditionA=aVal) OR (class=ClassB conditionB=bVal)) | eval time_classA=if((class=ClassA conditionA=aVal), _time, null()) | eval time_classB=if((class=ClassB conditionB=bVal), _time, null()) | stats count, latest(time_classA) as time_classA, latest(time_classB) as time_classB by rid | where time_classB > time_classA

Hope this helps. Kindly accept the solution if it is helpful.

topic Re: How to find the records based on another search but each happened afterwards in Splunk Search

How to find the records based on another search but each happened afterwards

Re: How to find the records based on another search but each happened afterwards