Splunk Search

Check latest status and print the reason on failure

Narmathavairava
Loves-to-Learn

Hi ,

 

I have the logs written in the below manner

26/08/2024 10:27 method=are status=failed run_id_123

26/08/2024 10:28 method=are status=failed run_id_123

26/08/2024 10:29 method=are status=failed run_id_123

26/08/2024 10:30 method=are status=completed run_id_123

failure_reason1

failure_reason_2

failure_reason_3

failure_reason_4

 

 

m trying to check the latest retry is completed or failed, if faile print the failure reason on the next 5 lines.

 

please help

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is not clear from this what you are expecting as your output. How do the failure_reason lines relate to the status lines?  Please can you share some actual events (anonymised as appropriate), preferably in a code block?

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.0.2 Availability: On cloud and On-premise!

A few months ago, we released Splunk Enterprise Security 8.0 for our cloud customers. Today, we are excited to ...

Logs to Metrics

Logs and Metrics Logs are generally unstructured text or structured events emitted by applications and written ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...