Splunk Search

How do you search for the string "error" after a particular string appears?

New Member


I would like to check for the string "ERROR" after the application is in a stable state.

The application logs the string "Starting server", from this point onwards, I would like to filter for the string "ERROR".

I'm thinking the the search should something like below:

index=app  | transaction startswith="Starting server" | map search=ERROR

Any ideas?

Many thanks

0 Karma


For transaction command to be effective, it is best to provide some unique identifier that ties events together eg: sessionid, userid, processid, guid etc. This helps transaction command group events more reliably. The startswith and endswith help better define boundary events within the transaction.

In you use case, it would be best to add a "transaction id". Regardless, you could add endswith="ERROR". This may give you what you are looking for.

Ideally you would have something like this

index=app | transaction some_uniqe_id startswith="Server started" endswith="Error" keepevicted=f 

or you could have keepevicted=t and filter out where closed_txn=0

Hope this gives you some ideas

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...