Hi,
We have applications Availability data in splunk. With below SPL, I got this data.
Base_SPL..| streamstats reset_on_change=true count as Real_Status by status,JonName
The challenge is to identify, if 2 or more successive failure have happened.
Only show ALL Fail events, if 2 or more successive failures. In the below table, only the contents highlighted in RED needs to be shown. (Ignore Failure, highlighted in GREEN) If i filter with below SPL, then i will miss the 1st FAIL event (Highlighted in RED)
where Real_Status > 1
So how do I solve this challenge?
JobName
status
Real_Status
Process1
SUCCESS
1
Process1
SUCCESS
2
Process1
FAIL
1
Process1
SUCCESS
1
Process1
FAIL
1
Process1
FAIL
2
Process1
FAIL
3
... View more