topic Re: If Then? Can this be done with Splunk in Splunk Search

If Then? Can this be done with Splunk

pwjohnston79 — Wed, 09 Oct 2013 20:22:33 GMT

First off, I’m not very strong in the scripting so If Then might not even be what I need to use. I thought Splunk just searched for errors, but I’ve been told to search for this.

I have a process that spits out a log with this entry
ApprovalExecutionJob:22 - BEGIN::Processing Approval Requests
It runs ever 15 min (0,15,30,45).

It takes about 5 min and then spit out this:
ApprovalExecutionJob:37 - END::Processing Approval Requests

If it does not produce this END process notice then we need to be notified. Can this be done in Splunk?

Re: If Then? Can this be done with Splunk

kristian_kolb — Wed, 09 Oct 2013 22:10:43 GMT

Yes, it can probably be performed in some way or another. Is the '22' and '37' some unique job ID's (or at least unique enough for the purpose of the search, e.g. do not repeat more than daily)? Then you can search like this;

sourcetype=your_sourcetype | rex "ApprovalExecutionJob:(?\d+)" | stats count by JobID | where count < 2

There are other options like e.g. transaction which may also be useful.

Re: If Then? Can this be done with Splunk

kphillipson — Thu, 10 Oct 2013 01:48:31 GMT

I have asked a question like this one. This might be of use.
http://answers.splunk.com/answers/84271/transaction-two-logs-alert-if-orphaned-for-30-mins

Re: If Then? Can this be done with Splunk

lukejadamec — Thu, 10 Oct 2013 02:20:48 GMT

If What > What Then. You need something in the logs that links the two events. Your example of events does not show a link.