Splunk Search

compare time field of the same type of message and raise an alert

pbao9801
New Member

8/1/19
8:58:38.084 PM

{"log":"| loglevel=\"INFO\" | thread=\"yyyyy\" | logger=\"xxxxx\" | message=\"Purely informational message\" | status=\"INFORMATIONAL\" | code=\"00002\" | Received=\"1000\" | reason=\"ABC Log\" | All Matching Count=\"29\" | Yawl Code KEY=\"INFORMATIONAL\" | Count=\"36\" \n","stream":"stdout","time":"2019-08-01T20:58:38.084436889Z"}

8/1/19
7:58:38.083 PM

{ [-]
log: | loglevel="INFO" | thread="yyyyy" | logger="xxxxx" | message="Purely informational message" | status="INFORMATIONAL" | code="00002" | Received="1000" | reason="ABC Log" | All Matching Count="29" | Yawl Code KEY="INFORMATIONAL" | Orderline Count="36"

These are information of the same type of message. How do I compare the time difference of the 2 messages above and raise an alert if the 2 message not arrive or above 30 minutes? These message are about an hour apart so it should raise an alert

Tags (1)
0 Karma

pbao9801
New Member

cut and paste and missing the time in the second message: it is the same type of format like the first one but an hour earlier "\n","stream":"stdout","time":"2019-08-01T20:58:38.084436889Z"

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...