Dynamic Alert from shown logs

[shraddhagrawal]

Hi,

I need to find errors/exceptions which has been raised within a timestamp and as per the request_id field mentioned in the logs(with every row) , need to fetch relevant logs in splunk  for that request_id and send this link to slack channel.

I am able to fetch all the errors/exception within timestamp and able to send to slack but I am not able to generate the relevant logs for the request_id mentioned with error/exception as it is dynamic in nature.

I am new to splunk so would like to understand, is this possible? if yes then could you please share relevant documentation so that I can understand it better.

Thank you so much.

[shraddhagrawal]

Thank you, let me check.

[ITWhisperer]

Since you have given your problem statement in generic terms, I will answer in the same manner. You could look to use the eventstats command to add / copy the exception indicator to all events with the corresponding request id. Then you can filter the event by whether the exception indicator is present.