Splunk Search

search for a string in field , if not there then trigger alert with remaining data in fields

kirrusk
Communicator

Hi,

I want to check for a string in the field, but if the string is not found in the field then need to print the remaining data. (last 15 mins data)

for example,

Field1      Field2             
9/2/10   successful
9/2/10   creating the file
9/2/10   created

from the above table, I want to check the Field2 for the last 15mins for string "successful", if no string is found in Field2 with "successful", Then need to trigger an alert with the remaining data like below.


Field1      Field2 
9/2/10   creating the file
9/2/10   created

is this possbile in splunk.

Labels (5)
Tags (1)
0 Karma
1 Solution

gcusello
Legend

Hi @kirrusk,

let me understand:

  • your need is a two phases check:
    • check if in Field2 there's the string "Successful",
    • then display the values of the Field2 field below "Successful"

Is this correct?

If this is your need, please try something like this:

index=your_index ield2=*
| transaction startswith="Successful"
| mvexpand field2
| search field2!="Successful"
| table _time field2

if the number of events after "Successful" is fixes (e.g. always 2), you could be more precise adding an option to the transaction command "maxevents=2".

Ciao.

Giuseppe

View solution in original post

gcusello
Legend

Hi @kirrusk,

let me understand:

  • your need is a two phases check:
    • check if in Field2 there's the string "Successful",
    • then display the values of the Field2 field below "Successful"

Is this correct?

If this is your need, please try something like this:

index=your_index ield2=*
| transaction startswith="Successful"
| mvexpand field2
| search field2!="Successful"
| table _time field2

if the number of events after "Successful" is fixes (e.g. always 2), you could be more precise adding an option to the transaction command "maxevents=2".

Ciao.

Giuseppe

kirrusk
Communicator

@gcusello 

@gcusello 
Thank you, but my intention is to trigger an alert with the remaining data in Field2.
if there is no string("Successful") at all in Field2.

sample alert,

no log found for successful, Please find logs

Field1             Field2
9/2/10         creating the file
9/2/10         created

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=your_index Field2=*
| eval check=if(Field2="Successful","Yes",null())
| eventstats values(check) AS check
| where isnull(check)
0 Karma

gcusello
Legend

Hi @kirrusk,

ok, please try something like this:

index=your_index field2=*
| eval check=if(field2="Successful","Yes","No")
| stats values(EventCode) AS EventCode values(check) AS check dc(check) AS dc_check earliest(_time) AS _time
| search dc_check=1 check=No
| mvexpand field2
| table _time field2

in this way, you check if in your logs there's the "Successful" string:

  • if present, there's no result in the search,
  • if not present, it displays all the field2 values.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...