If Then? Can this be done with Splunk

[pwjohnston79]

First off, I’m not very strong in the scripting so If Then might not even be what I need to use. I thought Splunk just searched for errors, but I’ve been told to search for this.

I have a process that spits out a log with this entry
ApprovalExecutionJob:22 - BEGIN::Processing Approval Requests
It runs ever 15 min (0,15,30,45).

It takes about 5 min and then spit out this:
ApprovalExecutionJob:37 - END::Processing Approval Requests

If it does not produce this END process notice then we need to be notified. Can this be done in Splunk?

[lukejadamec]

If What > What Then. You need something in the logs that links the two events. Your example of events does not show a link.

[kphillipson]

I have asked a question like this one. This might be of use.
http://answers.splunk.com/answers/84271/transaction-two-logs-alert-if-orphaned-for-30-mins

[kristian_kolb]

Yes, it can probably be performed in some way or another. Is the '22' and '37' some unique job ID's (or at least unique enough for the purpose of the search, e.g. do not repeat more than daily)? Then you can search like this;

sourcetype=your_sourcetype | rex "ApprovalExecutionJob:(?\d+)" | stats count by JobID | where count < 2

There are other options like e.g. transaction which may also be useful.

/K