Splunk Search

How to get exception data for multiple lines of Get and Update logs

EricMonkeyKing
Explorer

Hi community, can anyone help me figure out the log which Get incorrect data after Update(both get and update will log the request and response). In my case, the data can be updated multiple times. I need to guarantee all the Get can get correct data.

For example, there are 5 rows log:

1. Update A = 5,

2. Get A = 5,

3. Get A = 6,

4. Update A = 6, 

5. Get A = 6;

These logs are sorted based on time. Obviously the result obtained in the third row is incorrect, it should return A = 5.

The sample data is like:

idvaluetimeoperation
124945912FALSE1718280482get
124945938FALSE1718280373get
124945938FALSE1718280373update
124945938null1718280363get
124945937FALSE1718280348get
124945937FALSE1718280348update
124945937null1718280337get
124945936FALSE1718280330get
124945936FALSE1718280330update

 

Both id=124945937 and id=124945936 are correct since the obtained value after Update operation is same as Update value(false) even though the previous obtained value(null) which is before Update operation does not equal to Update value. Can ignore the Get operation if there is no Update operation before. Can anyone help? Thanks in advance^^

Labels (2)
0 Karma
1 Solution

P_vandereerden
Splunk Employee
Splunk Employee

Something like this should work if the timestamps are unique for each id:

index=mylogs
| sort + _time
| streamstats latest(eval(if(operation="update",value,NULL))) as Current by id 
| eval STATUS=case(isnull(Current),"OK",Current=value,"OK",1=1,"FAIL")

 

With sample data (adjusted slightly for demo purposes and unique timestamps):

 

| makeresults | eval id=124945912 | eval value="FALSE" | eval _time=1718280482 | eval operation="get"
| append [| makeresults | eval id=124945938 | eval value="FALSE" | eval _time=1718280373 | eval operation="get"]
| append [| makeresults | eval id=124945938 | eval value="FALSE" | eval _time=1718280373 | eval operation="update"]
| append [| makeresults | eval id=124945938 | eval value="null" | eval _time=1718280363 | eval operation="get"]
| append [| makeresults | eval id=124945937 | eval value="FALSE" | eval _time=1718280350 | eval operation="get"]
| append [| makeresults | eval id=124945937 | eval value="TRUE" | eval _time=1718280349 | eval operation="update"]
| append [| makeresults | eval id=124945937 | eval value="FALSE" | eval _time=1718280348 | eval operation="update"]
| append [| makeresults | eval id=124945937 | eval value="null" | eval _time=1718280337 | eval operation="get"]
| append [| makeresults | eval id=124945936 | eval value="FALSE" | eval _time=1718280331 | eval operation="get"]
| append [| makeresults | eval id=124945936 | eval value="FALSE" | eval _time=1718280330 | eval operation="update"]
| sort + _time
| streamstats latest(eval(if(operation="update",value,NULL))) as Current by id 
| eval STATUS=case(isnull(Current),"OK",Current=value,"OK",1=1,"FAIL")

 


 

Paul van der Eerden,
Breaking software for over 20 years.

View solution in original post

P_vandereerden
Splunk Employee
Splunk Employee

Something like this should work if the timestamps are unique for each id:

index=mylogs
| sort + _time
| streamstats latest(eval(if(operation="update",value,NULL))) as Current by id 
| eval STATUS=case(isnull(Current),"OK",Current=value,"OK",1=1,"FAIL")

 

With sample data (adjusted slightly for demo purposes and unique timestamps):

 

| makeresults | eval id=124945912 | eval value="FALSE" | eval _time=1718280482 | eval operation="get"
| append [| makeresults | eval id=124945938 | eval value="FALSE" | eval _time=1718280373 | eval operation="get"]
| append [| makeresults | eval id=124945938 | eval value="FALSE" | eval _time=1718280373 | eval operation="update"]
| append [| makeresults | eval id=124945938 | eval value="null" | eval _time=1718280363 | eval operation="get"]
| append [| makeresults | eval id=124945937 | eval value="FALSE" | eval _time=1718280350 | eval operation="get"]
| append [| makeresults | eval id=124945937 | eval value="TRUE" | eval _time=1718280349 | eval operation="update"]
| append [| makeresults | eval id=124945937 | eval value="FALSE" | eval _time=1718280348 | eval operation="update"]
| append [| makeresults | eval id=124945937 | eval value="null" | eval _time=1718280337 | eval operation="get"]
| append [| makeresults | eval id=124945936 | eval value="FALSE" | eval _time=1718280331 | eval operation="get"]
| append [| makeresults | eval id=124945936 | eval value="FALSE" | eval _time=1718280330 | eval operation="update"]
| sort + _time
| streamstats latest(eval(if(operation="update",value,NULL))) as Current by id 
| eval STATUS=case(isnull(Current),"OK",Current=value,"OK",1=1,"FAIL")

 


 

Paul van der Eerden,
Breaking software for over 20 years.

EricMonkeyKing
Explorer

That perfectly resolved my problem. Many thanks!!!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...