Search Help

[rtmcdonald]

Example communication log below:

05/03/2011 20:08:56, Port 4, TUL552189 ,WS=eLyn00f8, * Communication Link Failed

05/03/2011 20:08:56, Port 4, ST_013 ,WS=eLyn00e5,COM4:9600 N 8 1 Lt=0 Tout=10 Retry=2, Upload

05/03/2011 20:08:57, Port 1, ROSETTACPP,WS=eLyn00e2, -OK Number of bytes = 1273

05/03/2011 20:08:57, Port 2, PEOK014 ,WS=eLyn00e3, -OK Number of bytes = 929

05/03/2011 20:08:57, Port 5, TUL552200 ,WS=eLyn00f9, -OK Number of bytes = 524

05/03/2011 20:08:57, Port 3, WTGLA101 ,WS=eLyn00e4, -OK Number of bytes = 340. The size of uncompressed data is 604.

05/03/2011 20:08:57, Port 5, RH28FC1 ,WS=eLyn0081,COM5:9600 N 8 1 Lt=0 Tout=10 Retry=2, Upload

I'm trying to create an alert that will look for and entry "Communication Link Failed" and send an alert when there is an entry with "uncompressed data" within 5 seconds.

I've looked at transactions, but everything I tried didn't seem to work.

Thanks in advance!

-Ryan

[Ayn]

You should be able to achieve what you want using transaction. If you have one or more common field values to the events you want to group together it's desirable to tell transaction to use these fields. For instance you could use sourcetype and then define a transaction that has a timespan of 5 seconds and starts with "Communication Link Failed". After that you can search for the resulting transactions that include an entry with the text "uncompressed data".

<yourbasesearch> 
| transaction sourcetype maxspan=5s startswith="Communication Link Failed" 
| search "uncompressed data"

[gkanapathy]

I would recommend this be done using a realtime search as well, perhaps over the last 30 seconds or so.