Splunk Search

compare time field of the same type of message and raise an alert

pbao9801
New Member

8/1/19
8:58:38.084 PM

{"log":"| loglevel=\"INFO\" | thread=\"yyyyy\" | logger=\"xxxxx\" | message=\"Purely informational message\" | status=\"INFORMATIONAL\" | code=\"00002\" | Received=\"1000\" | reason=\"ABC Log\" | All Matching Count=\"29\" | Yawl Code KEY=\"INFORMATIONAL\" | Count=\"36\" \n","stream":"stdout","time":"2019-08-01T20:58:38.084436889Z"}

8/1/19
7:58:38.083 PM

{ [-]
log: | loglevel="INFO" | thread="yyyyy" | logger="xxxxx" | message="Purely informational message" | status="INFORMATIONAL" | code="00002" | Received="1000" | reason="ABC Log" | All Matching Count="29" | Yawl Code KEY="INFORMATIONAL" | Orderline Count="36"

These are information of the same type of message. How do I compare the time difference of the 2 messages above and raise an alert if the 2 message not arrive or above 30 minutes? These message are about an hour apart so it should raise an alert

Tags (1)
0 Karma

pbao9801
New Member

cut and paste and missing the time in the second message: it is the same type of format like the first one but an hour earlier "\n","stream":"stdout","time":"2019-08-01T20:58:38.084436889Z"

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>