Getting Data In

How to get events based on a repeated log

alejandrom_e
New Member

Hello,

I have a trace of events that we're logging as a JSON, correlated by an id field An example:

Event:

{
    "log": "{
        data of the current request
    }",
    "level": "INFO",
    "message": "message that it's repeated",
    "id": "an-uuid"
}

For the same ID, something like this can happen:

Log 1:

{
    "log": "{
        data of the current request
    }",
    "level": "INFO",
    "message": "message that it's repeated",
    "id": "an-uuid"
}

Log 2:

{
    "log": "{
        data of the current request
    }",
    "level": "INFO",
    "message": "message that it's repeated",
    "id": "an-uuid"
}

Log 3:

{
    "log": "{
        data of the current request
    }",
    "level": "INFO",
    "message": "message that it's repeated",
    "id": "an-uuid"
}

Log 4:

{
    "log": "{
        data of the current request
    }",
    "level": "INFO",
    "message": "another message",
    "id": "another-uuid"
}

I need to get those events that got the message field with the text "message that it's repeated" three times in a row. The timing is spaced by roughly 20 seconds between each log that contains that message.The result I'm expecting is only getting their IDs. Nothing else

That scenario represents a service call that we're retrying, but it's not happening in all the scenarios. I need to retrieve the id of those events.

I'm able to match the events that contains the message, but I didn't figure it out how to filter that dataset and I didn't find anything that help me with this so far.

Could you shed some light on this?

Thanks in advance!

0 Karma

woodcock
Esteemed Legend

Like this:

... | streamstats time_window=20 count(eval(message="message that it's repeated")) AS repeated_count BY id
| where repeated_count >= 3
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!