Combining logs and triggering alert

[vineela]

I need to combine logs from multiple events based on unique field and trigger an alert if order is missing in events generation.
Example :
If there is any transaction then events should generate in like wise order depending on reference number.
First event should be initiation followed by debit followed by verification followed by creditor verification and then money debit and credit into accounts.
Based on this i need to combine all the results in one order and trigger an alert if any event missed in this order.
Can anyone please help me on this????

[vineela]

That helps me a lot. Thanks

[richgalloway · Accepted solution]

That's not a lot to work with, but you may be successful counting transactions for each reference number and generating an alert if the number of transactions falls below an expected amount.

... | stats values(transaction) as transactions by referenceNumber
| where mvcount(transactions) < 5
| table referenceNumber transactions

[vineela]

I agree with you...but also i need to check which log is missing i mean in which step its failing to move further, That thing helps me much better in this case for easy solvation.
Thanks for your solution .
Can anyone help me on the same.

[richgalloway]

This should help find the missing transactions.  Add it to the end of the previous query.

| eval missing=""
| foreach "initiation" "debit" "verification" "creditor verification" "money debit and credit" [eval missing=missing . if(isnull(mvfind(transactions,"<<FIELD>>")),"<<FIELD>> ","")]
| table transactions missing