- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I need to combine logs from multiple events based on unique field and trigger an alert if order is missing in events generation.
Example :
If there is any transaction then events should generate in like wise order depending on reference number.
First event should be initiation followed by debit followed by verification followed by creditor verification and then money debit and credit into accounts.
Based on this i need to combine all the results in one order and trigger an alert if any event missed in this order.
Can anyone please help me on this????
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


That's not a lot to work with, but you may be successful counting transactions for each reference number and generating an alert if the number of transactions falls below an expected amount.
... | stats values(transaction) as transactions by referenceNumber
| where mvcount(transactions) < 5
| table referenceNumber transactions
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That helps me a lot. Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


That's not a lot to work with, but you may be successful counting transactions for each reference number and generating an alert if the number of transactions falls below an expected amount.
... | stats values(transaction) as transactions by referenceNumber
| where mvcount(transactions) < 5
| table referenceNumber transactions
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I agree with you...but also i need to check which log is missing i mean in which step its failing to move further, That thing helps me much better in this case for easy solvation.
Thanks for your solution .
Can anyone help me on the same.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


This should help find the missing transactions. Add it to the end of the previous query.
| eval missing=""
| foreach "initiation" "debit" "verification" "creditor verification" "money debit and credit" [eval missing=missing . if(isnull(mvfind(transactions,"<<FIELD>>")),"<<FIELD>> ","")]
| table transactions missing
If this reply helps you, Karma would be appreciated.
