Check first and last events in particular transaction and schedule alert

[vineela]

I am new to splunk. Please help me with the below content.
I need to check first and last events of particular transaction and alert should be triggered if the sequence is not followed or any process stopped in middle.
How can i do that ?
Can anyone please help me on the same?
Thanks in Advance

[ITWhisperer]

If all the events for the same transaction have the same unique transaction id, it is easy to use that as the correlation id to gather events together. Then check to see if the last event meets your criteria for an alert to be raised.

[vineela]

yes,all events have unique transaction id .Can you please tell me the query how to correlate all the events based on it and check if the last event is not success

[ITWhisperer]

--- search ---
| stats latest(event) as last_event earliest(event) as first_event by transactionid

event is the field you want to check and transactionid is your correlation id. stats will remove everything not mentioned from the pipeline, so if there are other field you are interested in, they need to be included in the stats command to e.g. latest(otherfield) as last_otherfield

Note that the latest and earliest functions behave slightly differently in different releases of splunk, so you may need to sort by _time first or possibly use last and first functions instead or possibly both of these.

[gcusello]

Hi @vineela,

could you share some sample of your logs?

Ciao.

Giuseppe