Splunk Search

compare time field of the same type of message and raise an alert

pbao9801
New Member

8/1/19
8:58:38.084 PM

{"log":"| loglevel=\"INFO\" | thread=\"yyyyy\" | logger=\"xxxxx\" | message=\"Purely informational message\" | status=\"INFORMATIONAL\" | code=\"00002\" | Received=\"1000\" | reason=\"ABC Log\" | All Matching Count=\"29\" | Yawl Code KEY=\"INFORMATIONAL\" | Count=\"36\" \n","stream":"stdout","time":"2019-08-01T20:58:38.084436889Z"}

8/1/19
7:58:38.083 PM

{ [-]
log: | loglevel="INFO" | thread="yyyyy" | logger="xxxxx" | message="Purely informational message" | status="INFORMATIONAL" | code="00002" | Received="1000" | reason="ABC Log" | All Matching Count="29" | Yawl Code KEY="INFORMATIONAL" | Orderline Count="36"

These are information of the same type of message. How do I compare the time difference of the 2 messages above and raise an alert if the 2 message not arrive or above 30 minutes? These message are about an hour apart so it should raise an alert

Tags (1)
0 Karma

pbao9801
New Member

cut and paste and missing the time in the second message: it is the same type of format like the first one but an hour earlier "\n","stream":"stdout","time":"2019-08-01T20:58:38.084436889Z"

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...