Searching a sequence of logs

[jacquesaxel]

Hi,

I made a lot of research and tests but I can't figure how to...

Is it possible to search a sequence of differents events in all the logs indexed in Splunk.

I mean, if in the search window, I have something like this :

---

....

event A

....

....

event B

....

---

Is there a search command which permit to search the sequence "event A then event B".
And after, use the result to create an alarm when I have this sequence of two events ?

I'm not an english speakers, so please forgive my bad english.
I hope my request is understandable anyway.

Axel

[bmacias84]

Yes the transaction comman with bounderies would be a good start, but also use event tags. Tag both events with something meaningfull.

Event A has tag=Error1

Event_B has tag=Error2

index=someindex AND (tag=Error1 or tag=Error2) | Transaction host startswith="unable to" endswith="connection failed" maxspan=1m 

Additional Reading:

• UseSplunkForEventCorrelation
• splunk-book-excerpt-grouping-events
• event-correlation
• Tageventtypes

Keep in mind that is only an example.

Hope this helps or gets you started. Dont forget to vote up and accept answers that help.

Cheers

[gfuente · Accepted solution]

Hello

You can use the transaction command with the parameters startswith and endswith to define transaction boundaries

Regards