Hi, I have an async producer/consumer each logging something like: producer: log.info("id=123, status=produced); consumer: log.info("id=123, status=consumed"); where id is the transaction ID. I want to get alerted only when producer is producing and for some reason consumer stopped consuming. I did write something like: index="myindex" sourcetype="mysourcetype" | transaction id startswith=(status="produced") endswith=(status="consumed") keepevicted=true maxevents=10 | stats count by closed_txn Then I ran both producer and consumer simultaneously and observed Splunk showing 0 and 1 for closed_txn. My assumption is that I should see closed_txn as 1 as both consumer and producer are running. Later I killed the consumer and let the producer keep running. Still I get closed_txn showing up as 1 and 0 whereas I thought Splunk should only report 0 as the transaction failed as there is no log from consumer. I am not sure if I am doing it right. In summary I want to get alerted when there is production but no consumption. I don't want to get alerted when there is no production. ... View more

I have logs like this: 10:40:00 AM: id=1,status=SUCCESS 10:45:17 AM: id=2,status=SUCCESS 11:00:23 AM: id=34,status=SUCCESS 11:15:49 AM: id=1,status=SUCCESS 11:20:59 AM: id=2,status=SUCCESS I want to write a query, that brings me only those records where I see logs for the same identifier in a short span of time. Look at this one: 10:40:00 AM: id=1,status=SUCCESS 10:40:02 AM: id=1,status=SUCCESS 10:40:15 AM: id=1,status=SUCCESS 10:45:17 AM: id=2,status=SUCCESS 10:45:23 AM: id=2,status=SUCCESS 11:00:23 AM: id=34,status=SUCCESS 11:15:49 AM: id=1,status=SUCCESS 11:20:59 AM: id=2,status=SUCCESS If you look at the above sample there are 3 success states for id=1 at 10:40:00, 10:40:02 and 10:40:15 and 2 success states for id=2 at 10:45:17 and 10:45:23 AM. I'm interested in this where I want to display repeated logs that happened in a short span of time. When I run a query the output has to be just the following: 10:40:00 AM: id=1,status=SUCCESS 10:40:02 AM: id=1,status=SUCCESS 10:40:15 AM: id=1,status=SUCCESS 10:45:17 AM: id=2,status=SUCCESS 10:45:23 AM: id=2,status=SUCCESS As for ID=1 and 2 I see many records within seconds (this will be something I want to specify in the query as well). ... View more