How to find first and last occurence of a value in a field when that value in the field gets changed?

[Arminder_Bhalla]

We have a requirement to count the total number of unscheduled outages in a month. The scenario is as follows:

1) We have monthly data available which has timestamp and a field “Status”. The values of Status is “S” for success and “F” for Failure.
2) The data should be monitored continuously for any failure occurred.
3) If any failure lasts for more than 5 mins, then it should be considered as an outage. But if failure is for less than 5 mins, then it should be ignored.
4) Similarly, while monitoring for failure, if any success occurs for less than 5 mins, then it should be ignored.

Please suggest any solution.

[dcarmack_splunk]

what does a cleared failure look like in the events?

[ddrillic]

I really like the transaction idea here ; -)

[javiergn]

I'm not a fan of the transaction command but it's probably going to help you a lot here. Link to docs.

What I would do on a very high level:

• Create a transaction for the relevant sourcetype and restrict the timespan accordingly (1 month for instance)
• Transaction should use the Status field to match consecutive events
• Use maxspan=5m
• Then filter the results by Status = F and create an alert based on the output

Hope that helps.

Thanks,
J