Splunk Search

search for a string in field , if not there then trigger alert with remaining data in fields

kirrusk
Communicator

Hi,

I want to check for a string in the field, but if the string is not found in the field then need to print the remaining data. (last 15 mins data)

for example,

Field1      Field2             
9/2/10   successful
9/2/10   creating the file
9/2/10   created

from the above table, I want to check the Field2 for the last 15mins for string "successful", if no string is found in Field2 with "successful", Then need to trigger an alert with the remaining data like below.


Field1      Field2 
9/2/10   creating the file
9/2/10   created

is this possbile in splunk.

Labels (5)
Tags (1)
0 Karma
1 Solution

gcusello
Legend

Hi @kirrusk,

let me understand:

  • your need is a two phases check:
    • check if in Field2 there's the string "Successful",
    • then display the values of the Field2 field below "Successful"

Is this correct?

If this is your need, please try something like this:

index=your_index ield2=*
| transaction startswith="Successful"
| mvexpand field2
| search field2!="Successful"
| table _time field2

if the number of events after "Successful" is fixes (e.g. always 2), you could be more precise adding an option to the transaction command "maxevents=2".

Ciao.

Giuseppe

View solution in original post

gcusello
Legend

Hi @kirrusk,

let me understand:

  • your need is a two phases check:
    • check if in Field2 there's the string "Successful",
    • then display the values of the Field2 field below "Successful"

Is this correct?

If this is your need, please try something like this:

index=your_index ield2=*
| transaction startswith="Successful"
| mvexpand field2
| search field2!="Successful"
| table _time field2

if the number of events after "Successful" is fixes (e.g. always 2), you could be more precise adding an option to the transaction command "maxevents=2".

Ciao.

Giuseppe

kirrusk
Communicator

@gcusello 

@gcusello 
Thank you, but my intention is to trigger an alert with the remaining data in Field2.
if there is no string("Successful") at all in Field2.

sample alert,

no log found for successful, Please find logs

Field1             Field2
9/2/10         creating the file
9/2/10         created

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=your_index Field2=*
| eval check=if(Field2="Successful","Yes",null())
| eventstats values(check) AS check
| where isnull(check)
0 Karma

gcusello
Legend

Hi @kirrusk,

ok, please try something like this:

index=your_index field2=*
| eval check=if(field2="Successful","Yes","No")
| stats values(EventCode) AS EventCode values(check) AS check dc(check) AS dc_check earliest(_time) AS _time
| search dc_check=1 check=No
| mvexpand field2
| table _time field2

in this way, you check if in your logs there's the "Successful" string:

  • if present, there's no result in the search,
  • if not present, it displays all the field2 values.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...