Example communication log below:
05/03/2011 20:08:56, Port 4, TUL552189 ,WS=eLyn00f8, * Communication Link Failed
05/03/2011 20:08:56, Port 4, ST_013 ,WS=eLyn00e5,COM4:9600 N 8 1 Lt=0 Tout=10 Retry=2, Upload
05/03/2011 20:08:57, Port 1, ROSETTACPP,WS=eLyn00e2, -OK Number of bytes = 1273
05/03/2011 20:08:57, Port 2, PEOK014 ,WS=eLyn00e3, -OK Number of bytes = 929
05/03/2011 20:08:57, Port 5, TUL552200 ,WS=eLyn00f9, -OK Number of bytes = 524
05/03/2011 20:08:57, Port 3, WTGLA101 ,WS=eLyn00e4, -OK Number of bytes = 340. The size of uncompressed data is 604.
05/03/2011 20:08:57, Port 5, RH28FC1 ,WS=eLyn0081,COM5:9600 N 8 1 Lt=0 Tout=10 Retry=2, Upload
I'm trying to create an alert that will look for and entry "Communication Link Failed" and send an alert when there is an entry with "uncompressed data" within 5 seconds.
I've looked at transactions, but everything I tried didn't seem to work.
Thanks in advance!
-Ryan
You should be able to achieve what you want using transaction
. If you have one or more common field values to the events you want to group together it's desirable to tell transaction
to use these fields. For instance you could use sourcetype
and then define a transaction that has a timespan of 5 seconds and starts with "Communication Link Failed". After that you can search for the resulting transactions that include an entry with the text "uncompressed data".
<yourbasesearch>
| transaction sourcetype maxspan=5s startswith="Communication Link Failed"
| search "uncompressed data"
I would recommend this be done using a realtime search as well, perhaps over the last 30 seconds or so.