Getting Data In

Search a particular source based on earlier search

prabhu_kar
New Member

Hi ,

I have user logs which are thousands in number per day. Iam trying to isolate users who had issues and then the issue went away.

It is akin to saying If I find a Error message like "unable to connect" in that particular user's file I want to find if he also got a "Reconnected" message. If it did not reconnect I want to pull those log files out or pull the rest of the log files. Each log file name has some pattern with which I can identify the user. Is there even a way for doing this ?

Thanks
Prabhu

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

To rephrase, you're trying to test if a source contains "unable to connect" but not "Reconnected" afterwards? You could run something like this:

... ("unable to connect" OR "Reconnected") | eval disconnect_time = case(match(_raw,"unable to connect"),_time) | eval reconnect_time = case(match(_raw,"Reconnected"),_time) | stats max(disconnect_time) as disconnect_time max(reconnect_time) as reconnect_time by source | where disconnect_time>0 AND NOT disconnect_time <= reconnect_time

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

To rephrase, you're trying to test if a source contains "unable to connect" but not "Reconnected" afterwards? You could run something like this:

... ("unable to connect" OR "Reconnected") | eval disconnect_time = case(match(_raw,"unable to connect"),_time) | eval reconnect_time = case(match(_raw,"Reconnected"),_time) | stats max(disconnect_time) as disconnect_time max(reconnect_time) as reconnect_time by source | where disconnect_time>0 AND NOT disconnect_time <= reconnect_time
0 Karma

prabhu_kar
New Member

yes Martin , something similar. Trying this idea out and see how it goes ..

0 Karma
Get Updates on the Splunk Community!

Splunk is Nurturing Tomorrow’s Cybersecurity Leaders Today

Meet Carol Wright. She leads the Splunk Academic Alliance program at Splunk. The Splunk Academic Alliance ...

Part 2: A Guide to Maximizing Splunk IT Service Intelligence

Welcome to the second segment of our guide. In Part 1, we covered the essentials of getting started with ITSI ...

Part 1: A Guide to Maximizing Splunk IT Service Intelligence

As modern IT environments continue to grow in complexity and speed, the ability to efficiently manage and ...