All Apps and Add-ons

I want to alert only if error of event has been occurred continuously for last 4 days

DataOrg
Builder

I have log which has time stamp, tag, and i calculating how many time has been occurred per day. i want to get results if the events has been continuously happened on last 4 days but its returns for last 5 days. As we see below 21st has no data but still it reported as time range selected was last 4 days.

 

index=* | eval epochtime=strptime(Log_Message_Time, "%m/%d/%Y %H:%M:%S")
| eval Event_Date=strftime(epochtime, "%d-%m-%Y")
| stats delim="," values(Tag) AS _Tag values(Buffer_Value) AS Buffer_Value values(diff) AS diff count AS Per_Day_Occurance BY Event_Date host
| mvexpand Buffer_Value
| mvcombine Log_Message_Tag
| rename host AS Server
| eventstats count AS Days BY Server
| search Days>=4
| join type=left Server [|inputlookup pg_ld_production_servers | table Server Site]
| table Site Server Event_Date Log_Message_Tag Per_Day_Occurance diff
| sort Event_Date
| rename Log_Message_Tag AS "Historian Tag" Event_Date AS "Event Date"

 

 

 hostevent datetagOccured per day     
 BELL-MESAPPBC120-05-2021tag1,tag2,tag32     
2host22-05-2021tag2,tag4,tag5,tag13     
3host23-05-2021tag14     
4host24-05-2021tag2,tag35     
          

 

Labels (1)
Tags (2)
0 Karma

DataOrg
Builder

@kamlesh_vaghela  could you pls help me here?

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...