Hello, Splunk noob here. I'd like to find in my index users who encounters an error during a phase of a process but later, for the same phase, are able to succeed. So it would be something like this:
User=A phase="something" result=error 10:00 AM
User=A phase="something" result=success 10:05 AM
I'd like to be able to gather all of the users who face a similar situation.
Anyone can suggest a solution?
Thanks a lot in advance.
Hey there, Looks like you need to add a "filter" that says "return all the events for this User A that has error and success for this period of time" .
Also there is "Alerts" that you could create which will give you basically alerts on such events.
May be something like this would work.
your search
| stats latest(result) as latest values(result) as results by User phase
| where latest="success" AND isnotnull(mvfind(match(results,"error")))
@somesoni2 maybe I am doing some mistakes putting my real values instead of placeholders, but it doesn't seem to be working. Thanks a lot anyway!
Would you mind sharing the search you're trying with? Scrub anything sensitive. Did you get any error running above search OR just the output is not as expected?
@BoGiulio what if there is an error after success again? Is there supposed to be excluded?
@niketnilay for the data I'm focusing on there can't be a sequence success-error, only sometimes error-success; after the user has success for a specific phase, it goes to the next one. Thanks a lot for your time.