All Apps and Add-ons

I want to alert only if error of event has been occurred continuously for last 4 days


I have log which has time stamp, tag, and i calculating how many time has been occurred per day. i want to get results if the events has been continuously happened on last 4 days but its returns for last 5 days. As we see below 21st has no data but still it reported as time range selected was last 4 days.


index=* | eval epochtime=strptime(Log_Message_Time, "%m/%d/%Y %H:%M:%S")
| eval Event_Date=strftime(epochtime, "%d-%m-%Y")
| stats delim="," values(Tag) AS _Tag values(Buffer_Value) AS Buffer_Value values(diff) AS diff count AS Per_Day_Occurance BY Event_Date host
| mvexpand Buffer_Value
| mvcombine Log_Message_Tag
| rename host AS Server
| eventstats count AS Days BY Server
| search Days>=4
| join type=left Server [|inputlookup pg_ld_production_servers | table Server Site]
| table Site Server Event_Date Log_Message_Tag Per_Day_Occurance diff
| sort Event_Date
| rename Log_Message_Tag AS "Historian Tag" Event_Date AS "Event Date"



 hostevent datetagOccured per day     


Labels (2)
Tags (2)
0 Karma


@kamlesh_vaghela  could you pls help me here?

0 Karma
Get Updates on the Splunk Community!

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...