Getting Data In

Search a particular source based on earlier search

prabhu_kar
New Member

Hi ,

I have user logs which are thousands in number per day. Iam trying to isolate users who had issues and then the issue went away.

It is akin to saying If I find a Error message like "unable to connect" in that particular user's file I want to find if he also got a "Reconnected" message. If it did not reconnect I want to pull those log files out or pull the rest of the log files. Each log file name has some pattern with which I can identify the user. Is there even a way for doing this ?

Thanks
Prabhu

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

To rephrase, you're trying to test if a source contains "unable to connect" but not "Reconnected" afterwards? You could run something like this:

... ("unable to connect" OR "Reconnected") | eval disconnect_time = case(match(_raw,"unable to connect"),_time) | eval reconnect_time = case(match(_raw,"Reconnected"),_time) | stats max(disconnect_time) as disconnect_time max(reconnect_time) as reconnect_time by source | where disconnect_time>0 AND NOT disconnect_time <= reconnect_time

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

To rephrase, you're trying to test if a source contains "unable to connect" but not "Reconnected" afterwards? You could run something like this:

... ("unable to connect" OR "Reconnected") | eval disconnect_time = case(match(_raw,"unable to connect"),_time) | eval reconnect_time = case(match(_raw,"Reconnected"),_time) | stats max(disconnect_time) as disconnect_time max(reconnect_time) as reconnect_time by source | where disconnect_time>0 AND NOT disconnect_time <= reconnect_time
0 Karma

prabhu_kar
New Member

yes Martin , something similar. Trying this idea out and see how it goes ..

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...