Splunk Search

Search that alerts if one event exists and another does not

hcannon
Path Finder

I have two types of events in the same index:

2016-10-27 00:43:49.722 event=file_change
2016-10-27 00:43:54.000 event=git_commit

I need to alert specifically when event=git_commit does NOT occur within 5 minutes of event=file_change

It seems that there are a few ways to go about this, using join or append or transaction - but given that my end goal is just an alert that one event exists without the other, I'm not sure which is the best search command to go with, given that I need a "if this and NOT that, alert". Any suggestions welcome!

Tags (3)
0 Karma
1 Solution

cmerriman
Super Champion

I'd use transaction

...|transaction event startswith="file_change" max_span=5m|search eventcount=1

that should give you any transaction that only has a file_change with no git_commit within 5 minutes.

View solution in original post

somesoni2
Revered Legend

Give this a try

your base search | transaction startswith=event="file_change" endswith=event="git_commit" | where duration>300

cmerriman
Super Champion

I'd use transaction

...|transaction event startswith="file_change" max_span=5m|search eventcount=1

that should give you any transaction that only has a file_change with no git_commit within 5 minutes.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...