Splunk search logs

ramanapvr — Mon, 01 Jun 2015 10:25:05 GMT

Am having log entries as per below.

In essence, we have to detect a line with “Task started. Task id - 'number' an save the number for task id.
Then we have to detect another line with “Task completed. Task id - 'number' and the same number.

'number' will be keep changing in logs, so we have to scann the 'number' and then alert if start or stop is failed. Can i have query which will meet the requirement.

If we find those two lines without any error logs in between, then we are good. If there are ERROR logs in between then we have to raise an alarm.

Re: Splunk search logs

jeffland — Mon, 01 Jun 2015 11:11:39 GMT

If you want something like your number for further use, you should extract it as a field. If this is a sporadic need, you may want to do a search with the command rex in it, which should look something like

your search so far | rex "Task id - '(?<number>\d+)'" | table number

(provided the single quotes around number are present in your logs, if not remove them from the command). That will enable you to use a field with the name "number" just like any other field such as host or sourcetype, as I did with table above.

If this is needed more frequently, you may want to do this with automatic field extractions - simply use the same regular expression as above use Settings - Fields - Field Extractions. If you don't know what fields are, start here.

Regarding how you from there get to what you need in the end, you might be interested in transaction. I'm thinking of something like

... | transaction number startswith="Task started" endswith="Task completed"

and from there search for your error logs to raise alarms.

topic Splunk search logs in Splunk Search

Splunk search logs

Re: Splunk search logs