Splunk Search

Extract common user who encounters different values for the same field over time

BoGiulio
New Member

Hello, Splunk noob here. I'd like to find in my index users who encounters an error during a phase of a process but later, for the same phase, are able to succeed. So it would be something like this:

User=A phase="something" result=error 10:00 AM
User=A phase="something" result=success 10:05 AM

I'd like to be able to gather all of the users who face a similar situation.
Anyone can suggest a solution?

Thanks a lot in advance.

Tags (1)
0 Karma

LxSenpai
Explorer

Hey there, Looks like you need to add a "filter" that says "return all the events for this User A that has error and success for this period of time" .

Also there is "Alerts" that you could create which will give you basically alerts on such events.

0 Karma

somesoni2
Revered Legend

May be something like this would work.

your search
| stats latest(result) as latest values(result) as results by User phase
| where latest="success" AND isnotnull(mvfind(match(results,"error")))
0 Karma

BoGiulio
New Member

@somesoni2 maybe I am doing some mistakes putting my real values instead of placeholders, but it doesn't seem to be working. Thanks a lot anyway!

0 Karma

somesoni2
Revered Legend

Would you mind sharing the search you're trying with? Scrub anything sensitive. Did you get any error running above search OR just the output is not as expected?

0 Karma

niketn
Legend

@BoGiulio what if there is an error after success again? Is there supposed to be excluded?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

BoGiulio
New Member

@niketnilay for the data I'm focusing on there can't be a sequence success-error, only sometimes error-success; after the user has success for a specific phase, it goes to the next one. Thanks a lot for your time.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...