Alerting

Check first and last events in particular transaction and schedule alert

vineela
Path Finder

I am new to splunk. Please help me with the below content.
I need to check first and last events of particular transaction and alert should be triggered if the sequence is not followed or any process stopped in middle.
How can i do that ?
Can anyone please help me on the same?
Thanks in Advance

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If all the events for the same transaction have the same unique transaction id, it is easy to use that as the correlation id to gather events together. Then check to see if the last event meets your criteria for an alert to be raised.

0 Karma

vineela
Path Finder

yes,all events have unique transaction id .Can you please tell me the query how to correlate all the events based on it and check if the last event is not success

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
--- search ---
| stats latest(event) as last_event earliest(event) as first_event by transactionid

event is the field you want to check and transactionid is your correlation id. stats will remove everything not mentioned from the pipeline, so if there are other field you are interested in, they need to be included in the stats command to e.g. latest(otherfield) as last_otherfield

Note that the latest and earliest functions behave slightly differently in different releases of splunk, so you may need to sort by _time first or possibly use last and first functions instead or possibly both of these.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @vineela,

could you share some sample of your logs?

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...