Hi All, I am rather hoping someone can assist me in creating a search that can be used for an alert to detect when a connection to MQ fails to re-connect for a system I am supporting. I am new to Splunk and although I have found posts related to this topic, I have so far not been able to adapt them for my particular scenario. I was hopeful the search below would suffice, but then realised it only works as I wanted it to if the MQ connection actually drops, otherwise the count evaluates as 0 and I end up with a false alerts.
index="sepa_instant"
source="D:\\Apps\\Instant_Sepa_01\\log\\ContinuityRequester*"
| transaction startswith="connection_down_error raised" maxspan=4m
| search "-INFOS- {3} QM reconnected"
| stats count
| where count="0"
Any assistance provided would be very much appreciated.
... View more