All Apps and Add-ons

I want to alert only if error of event has been occurred continuously for last 4 days


I have log which has time stamp, tag, and i calculating how many time has been occurred per day. i want to get results if the events has been continuously happened on last 4 days but its returns for last 5 days. As we see below 21st has no data but still it reported as time range selected was last 4 days.


index=* | eval epochtime=strptime(Log_Message_Time, "%m/%d/%Y %H:%M:%S")
| eval Event_Date=strftime(epochtime, "%d-%m-%Y")
| stats delim="," values(Tag) AS _Tag values(Buffer_Value) AS Buffer_Value values(diff) AS diff count AS Per_Day_Occurance BY Event_Date host
| mvexpand Buffer_Value
| mvcombine Log_Message_Tag
| rename host AS Server
| eventstats count AS Days BY Server
| search Days>=4
| join type=left Server [|inputlookup pg_ld_production_servers | table Server Site]
| table Site Server Event_Date Log_Message_Tag Per_Day_Occurance diff
| sort Event_Date
| rename Log_Message_Tag AS "Historian Tag" Event_Date AS "Event Date"



 hostevent datetagOccured per day     


Labels (2)
Tags (2)
0 Karma


@kamlesh_vaghela  could you pls help me here?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...