Alerting

Combining logs and triggering alert

vineela
Path Finder

I need to combine logs from multiple events based on unique field and trigger an alert if order is missing in events generation.
Example :
If there is any transaction then events should generate in like wise order depending on reference number.
First event should be initiation followed by debit followed by verification followed by creditor verification and then money debit and credit into accounts.
Based on this i need to combine all the results in one order and trigger an alert if any event missed in this order.
Can anyone please help me on this????

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

That's not a lot to work with, but you may be successful counting transactions for each reference number and generating an alert if the number of transactions falls below an expected amount.

... | stats values(transaction) as transactions by referenceNumber
| where mvcount(transactions) < 5
| table referenceNumber transactions
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

vineela
Path Finder

That helps me a lot. Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That's not a lot to work with, but you may be successful counting transactions for each reference number and generating an alert if the number of transactions falls below an expected amount.

... | stats values(transaction) as transactions by referenceNumber
| where mvcount(transactions) < 5
| table referenceNumber transactions
---
If this reply helps you, Karma would be appreciated.
0 Karma

vineela
Path Finder

I agree with you...but also i need to check which log is missing i mean in which step its failing to move further, That thing helps me much better in this case for easy solvation.
Thanks for your solution .
Can anyone help me on the same.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This should help find the missing transactions.  Add it to the end of the previous query.

| eval missing=""
| foreach "initiation" "debit" "verification" "creditor verification" "money debit and credit" [eval missing=missing . if(isnull(mvfind(transactions,"<<FIELD>>")),"<<FIELD>> ","")]
| table transactions missing

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...