Splunk Search

How to dynamically change table contents based on log messages?

kiddsupreme
Explorer

Not sure if I am putting this in the correct area; my apologies ahead of time. I wanted to know if it would be possible to have Splunk dynamically populate a table based on incoming log messages. The log messages for new alerts and cleared alerts are essentially the same, save for one "field" that shows either "NEW" or "CLEARED".

##Example of New Alert Log Message## 

2022-10-06 05:58:31
AlarmNotification = NEW
AlarmID = STRING: "123456789"
AlarmType = INTEGER: 1
ObjectInstance = STRING: "Router1"
EventTime = STRING: "2022-10-6,5:58:31.7,-7:0"
SpecificProblem = STRING: "LinkDown"
Severity = INTEGER: 2

 

##Example of Clear Alert Log Message##

 

2022-10-06 05:58:35
AlarmNotification = CLEARED
AlarmID = STRING: "123456789"
AlarmType = INTEGER: 1
ObjectInstance = STRING: "Router1"
EventTime = STRING: "2022-10-6,5:58:35.5,-7:0"
SpecificProblem = STRING: "LinkDown"
Severity = INTEGER: 2

 

-----------------------------------

My idea was anytime a new alert comes in, a table with the various fields is generated; I can already do that today. However, what I am not sure about is if a subsequent "clear" log message comes in where everything matches (with the exception of the AlarmNotification and EventTime), it would dynamically REMOVE that table row entry.

 

So the general idea is show the alerts when they come in, but if a cleared alert message that comes in with a later date and time would "delete" that row from the table.

 

Any and all suggestions are welcomed. Thank you in advance.

Labels (3)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

I thought the entire idea of Splunk is to dynamically change table content based on log messages.  No?  Joking aside, one possible method is to use transaction.

| transaction startswith="AlarmNotification=NEW" endswith="AlarmNotification=CLEARED" AlarmID
| where closed_txn == 0

Here I assume that AlarmID uniquely identifies an alarm that is being cleared.  If not, you can add other fields necessary to identify alarm.

There are many methods to use stats to accomplish this, too.  Assuming AlarmID is unique, you can do

| stats values(*) as * by AlarmID
| where NOT AlarmNotification == "CLEARED"

Transaction is expensive.  So stats is usually preferred.

Hope this helps.

 

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...