Splunk Search

compare time field of the same type of message and raise an alert

pbao9801
New Member

8/1/19
8:58:38.084 PM

{"log":"| loglevel=\"INFO\" | thread=\"yyyyy\" | logger=\"xxxxx\" | message=\"Purely informational message\" | status=\"INFORMATIONAL\" | code=\"00002\" | Received=\"1000\" | reason=\"ABC Log\" | All Matching Count=\"29\" | Yawl Code KEY=\"INFORMATIONAL\" | Count=\"36\" \n","stream":"stdout","time":"2019-08-01T20:58:38.084436889Z"}

8/1/19
7:58:38.083 PM

{ [-]
log: | loglevel="INFO" | thread="yyyyy" | logger="xxxxx" | message="Purely informational message" | status="INFORMATIONAL" | code="00002" | Received="1000" | reason="ABC Log" | All Matching Count="29" | Yawl Code KEY="INFORMATIONAL" | Orderline Count="36"

These are information of the same type of message. How do I compare the time difference of the 2 messages above and raise an alert if the 2 message not arrive or above 30 minutes? These message are about an hour apart so it should raise an alert

Tags (1)
0 Karma

pbao9801
New Member

cut and paste and missing the time in the second message: it is the same type of format like the first one but an hour earlier "\n","stream":"stdout","time":"2019-08-01T20:58:38.084436889Z"

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...