Extract common user who encounters different values for the same field over time

[BoGiulio]

Hello, Splunk noob here. I'd like to find in my index users who encounters an error during a phase of a process but later, for the same phase, are able to succeed. So it would be something like this:

User=A phase="something" result=error 10:00 AM
User=A phase="something" result=success 10:05 AM

I'd like to be able to gather all of the users who face a similar situation.
Anyone can suggest a solution?

Thanks a lot in advance.

[LxSenpai]

Hey there, Looks like you need to add a "filter" that says "return all the events for this User A that has error and success for this period of time" .

Also there is "Alerts" that you could create which will give you basically alerts on such events.

[somesoni2]

May be something like this would work.

your search
| stats latest(result) as latest values(result) as results by User phase
| where latest="success" AND isnotnull(mvfind(match(results,"error")))

[BoGiulio]

@somesoni2 maybe I am doing some mistakes putting my real values instead of placeholders, but it doesn't seem to be working. Thanks a lot anyway!

[somesoni2]

Would you mind sharing the search you're trying with? Scrub anything sensitive. Did you get any error running above search OR just the output is not as expected?

[niketn]

@BoGiulio what if there is an error after success again? Is there supposed to be excluded?

[BoGiulio]

@niketnilay for the data I'm focusing on there can't be a sequence success-error, only sometimes error-success; after the user has success for a specific phase, it goes to the next one. Thanks a lot for your time.