Splunk Search

Joining two events and compare to needed result

dharbhm
New Member

Hi , 

I am trying to find the list of ids that fail from my logs. 

Say I have 

2023-11-14T10:30:30,118 INFO Operation failed

.....

......

2023-11-14T10:30:40,118 INFO Operation ID ABCD

.............

2023-11-14T10:35:25,118 INFO Operation success

.....

......

2023-11-14T10:35:30,118 INFO Operation id 1234

''''''

 

I am trying to get the information as

Time stampStatusID
2023-11-14T10:30:30failedABCD
2023-11-14T10:30:30Success1234

 

I appreciate any help 

Thanks 

 

Labels (1)
0 Karma

dharbhm
New Member

In case of success the info is 

http-nio-8080-exec-14 nteg 2023-11-14T10:33:30,062 INFO REQEST XML
http-nio-8080-exec-14 nteg 2023-11-14T10:33:30,062 INFO Operation started
http-nio-8080-exec-14 nteg 2023-11-14T10:33:30,118 INFO Operation Success
http-nio-8080-exec-14 nteg 2023-11-14T10:33:30,118 INFO request processed
http-nio-8080-exec-14 nteg 2023-11-14T10:33:30,118 INFO Processed {1234-6789}

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Copy/Paste this example into your search window

| makeresults
| eval _raw="http-nio-8080-exec-6 nteg 2023-11-14T10:30:30,062 INFO REQEST XML
http-nio-8080-exec-6 nteg 2023-11-14T10:30:30,062 INFO Operation started
http-nio-8080-exec-6 nteg 2023-11-14T10:30:30,112 ERROR Operation error
.WsdlFault: Failed to process
CALL STACk
http-nio-8080-exec-6 nteg 2023-11-14T10:30:30,118 INFO Operation failed
http-nio-8080-exec-6 nteg 2023-11-14T10:30:30,118 INFO request processed
http-nio-8080-exec-6 nteg 2023-11-14T10:30:30,118 ERROR exception thrown regarding {ABCDEFGH-IJKL}
http-nio-8080-exec-6 nteg 2023-11-14T10:30:30,118 ERROR exception thrown regarding {ABCDEFGH-IJKL}
http-nio-8080-exec-14 nteg 2023-11-14T10:33:30,062 INFO REQEST XML
http-nio-8080-exec-14 nteg 2023-11-14T10:33:30,062 INFO Operation started
http-nio-8080-exec-14 nteg 2023-11-14T10:33:30,118 INFO Operation Success
http-nio-8080-exec-14 nteg 2023-11-14T10:33:30,118 INFO request processed
http-nio-8080-exec-14 nteg 2023-11-14T10:33:30,118 INFO Processed {1234-6789}"
| multikv noheader=t
| eval _raw=Column_1.if(len(Column_2)>0,",".Column_2,"")
| table _raw
| rex "(?<t>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2},\d{3})"
| eval _time=strptime(t, "%FT%T,%Q")
``` Your data set up above ```
| rex "http-nio-8080-exec-(?<id>\d+).* (?<status>INFO|ERROR) (?<message>.*)"
| rex field=message "\{(?<op_id>\w+-\w+)"
| eval status=case(message="Operation failed", "Failed", message="Operation Success", "Success", true(), null())
| stats min(eval(if(message="Operation started", _time, null()))) as Op_Started values(op_id) as op_id values(status) as status by id

It takes your example data and assumes the first part is some kind of thread id and then does some extractions to join the data together.

If that thread id can occur more than once in your search range, then this won't work

0 Karma

dharbhm
New Member

Thanks @bowesmana  I appreciate your help !!!!

0 Karma

dharbhm
New Member

Thanks @bowesmana , for looking into this.

Good point that Success/failed message relates to specific id or not , that is why I am trying to map to the time stamp of success/fail to that processed id and as well as filter to a host to compare.

the actual log info is 

http-nio-8080-exec-6 nteg 2023-11-14T10:30:30,062 INFO REQEST XML
http-nio-8080-exec-6 nteg 2023-11-14T10:30:30,062 INFO Operation started
http-nio-8080-exec-6 nteg 2023-11-14T10:30:30,112 ERROR Operation error
.WsdlFault: Failed to process
CALL STACk
http-nio-8080-exec-6 nteg 2023-11-14T10:30:30,118 INFO Operation failed
http-nio-8080-exec-6 nteg 2023-11-14T10:30:30,118 INFO request processed
http-nio-8080-exec-6 nteg 2023-11-14T10:30:30,118 ERROR exception thrown regarding {ABCDEFGH-IJKL}
http-nio-8080-exec-6 nteg 2023-11-14T10:30:30,118 ERROR exception thrown regarding {ABCDEFGH-IJKL}

Thanks

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Does this mean anything

http-nio-8080-exec-6

is that some kind of thread id?

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

How do you know that the success/failed message relates to a specific id?

In your example, the status comes before the message id event. What you have more than one event id coming and they are out of sync?

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...