Splunk Search

Splunk search logs

ramanapvr
New Member

Am having log entries as per below.

In essence, we have to detect a line with “Task started. Task id - 'number' an save the number for task id.
Then we have to detect another line with “Task completed. Task id - 'number' and the same number.

'number' will be keep changing in logs, so we have to scann the 'number' and then alert if start or stop is failed. Can i have query which will meet the requirement.

If we find those two lines without any error logs in between, then we are good. If there are ERROR logs in between then we have to raise an alarm.

Tags (3)
0 Karma

jeffland
SplunkTrust
SplunkTrust

If you want something like your number for further use, you should extract it as a field. If this is a sporadic need, you may want to do a search with the command rex in it, which should look something like

your search so far | rex "Task id - '(?<number>\d+)'" | table number

(provided the single quotes around number are present in your logs, if not remove them from the command). That will enable you to use a field with the name "number" just like any other field such as host or sourcetype, as I did with table above.

If this is needed more frequently, you may want to do this with automatic field extractions - simply use the same regular expression as above use Settings - Fields - Field Extractions. If you don't know what fields are, start here.

Regarding how you from there get to what you need in the end, you might be interested in transaction. I'm thinking of something like

... | transaction number startswith="Task started" endswith="Task completed"

and from there search for your error logs to raise alarms.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...