topic Re: Search that alerts if one event exists and another does not in Splunk Search

Search that alerts if one event exists and another does not

hcannon — Tue, 29 Sep 2020 11:34:20 GMT

I have two types of events in the same index:

2016-10-27 00:43:49.722 event=file_change
2016-10-27 00:43:54.000 event=git_commit

I need to alert specifically when event=git_commit does NOT occur within 5 minutes of event=file_change

It seems that there are a few ways to go about this, using join or append or transaction - but given that my end goal is just an alert that one event exists without the other, I'm not sure which is the best search command to go with, given that I need a "if this and NOT that, alert". Any suggestions welcome!

Re: Search that alerts if one event exists and another does not

cmerriman — Tue, 29 Sep 2020 11:37:21 GMT

I'd use transaction

...|transaction event startswith="file_change" max_span=5m|search eventcount=1

that should give you any transaction that only has a file_change with no git_commit within 5 minutes.

Re: Search that alerts if one event exists and another does not

somesoni2 — Fri, 28 Oct 2016 14:49:02 GMT

Give this a try

your base search | transaction startswith=event="file_change" endswith=event="git_commit" | where duration>300