Getting Data In

Search a particular source based on earlier search

New Member

Hi ,

I have user logs which are thousands in number per day. Iam trying to isolate users who had issues and then the issue went away.

It is akin to saying If I find a Error message like "unable to connect" in that particular user's file I want to find if he also got a "Reconnected" message. If it did not reconnect I want to pull those log files out or pull the rest of the log files. Each log file name has some pattern with which I can identify the user. Is there even a way for doing this ?

Thanks
Prabhu

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

To rephrase, you're trying to test if a source contains "unable to connect" but not "Reconnected" afterwards? You could run something like this:

... ("unable to connect" OR "Reconnected") | eval disconnect_time = case(match(_raw,"unable to connect"),_time) | eval reconnect_time = case(match(_raw,"Reconnected"),_time) | stats max(disconnect_time) as disconnect_time max(reconnect_time) as reconnect_time by source | where disconnect_time>0 AND NOT disconnect_time <= reconnect_time

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

To rephrase, you're trying to test if a source contains "unable to connect" but not "Reconnected" afterwards? You could run something like this:

... ("unable to connect" OR "Reconnected") | eval disconnect_time = case(match(_raw,"unable to connect"),_time) | eval reconnect_time = case(match(_raw,"Reconnected"),_time) | stats max(disconnect_time) as disconnect_time max(reconnect_time) as reconnect_time by source | where disconnect_time>0 AND NOT disconnect_time <= reconnect_time

View solution in original post

0 Karma

New Member

yes Martin , something similar. Trying this idea out and see how it goes ..

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!