Search Query

[anandhalagarasa]

Hi Team,

There is an requirement in writing the search query. i.e.

index=xyz host=abc source=mno "Server starting" .

Actually the keyword "Server Starting" would be there atleast as 4 events in a minute. So i want the query to be in such a way of the keyword "Server Starting" is not present in the log for last 5 minutes then it needs to trigger an alert.

So in a minute the keyword "Server Starting" would be surely captured for 4 times atleast. So if the keyword is not present in the log for 5 minutes then it needs to trigger an alert.

So kindly help on the query.

[woodcock]

Like this:

index=xyz host=abc source=mno "Server starting"
| streamstats count time_window=1m
| where count <= 4

[renjith_nair]

@anandhalagarasan ,

Try

     index=xyz host=abc source=mno "Server starting"
    |stats latest(_time) as _time
    |eval delay=round((now()-_time)/60,2)|appendpipe [stats count|where count=0|eval delay=9999999]
    |where delay >5

appendpipe is required in case you dont have the events for the selected time range. In that case , the result will be empty and the where condition evaluates to false.

[anandhalagarasa]

@renjith.nair

Thanks for your swift response.

When I used your query and ran for all time the result seems to be showing as count=0 and delay=9999999

But my requirement is that if the keyword is not present in last 5 minutes of log then we need to get an alert.

So kindly let me know.

[renjith_nair]

@anandhalagarasan ,

That indicates that you dont have the event which satisfies the condition. Do you have any events which has "Server starting" in it ?

Just to be sure , index, host and other search terms have to be adjusted to your actual value