Hi,
I want to check for a string in the field, but if the string is not found in the field then need to print the remaining data. (last 15 mins data)
for example,
Field1 Field2
9/2/10 successful
9/2/10 creating the file
9/2/10 created
from the above table, I want to check the Field2 for the last 15mins for string "successful", if no string is found in Field2 with "successful", Then need to trigger an alert with the remaining data like below.
Field1 Field2
9/2/10 creating the file
9/2/10 created
is this possbile in splunk.
Hi @kirrusk,
let me understand:
Is this correct?
If this is your need, please try something like this:
index=your_index ield2=*
| transaction startswith="Successful"
| mvexpand field2
| search field2!="Successful"
| table _time field2
if the number of events after "Successful" is fixes (e.g. always 2), you could be more precise adding an option to the transaction command "maxevents=2".
Ciao.
Giuseppe
Hi @kirrusk,
let me understand:
Is this correct?
If this is your need, please try something like this:
index=your_index ield2=*
| transaction startswith="Successful"
| mvexpand field2
| search field2!="Successful"
| table _time field2
if the number of events after "Successful" is fixes (e.g. always 2), you could be more precise adding an option to the transaction command "maxevents=2".
Ciao.
Giuseppe
@gcusello
Thank you, but my intention is to trigger an alert with the remaining data in Field2.
if there is no string("Successful") at all in Field2.
sample alert,
no log found for successful, Please find logs
Field1 Field2
9/2/10 creating the file
9/2/10 created
index=your_index Field2=*
| eval check=if(Field2="Successful","Yes",null())
| eventstats values(check) AS check
| where isnull(check)
Hi @kirrusk,
ok, please try something like this:
index=your_index field2=*
| eval check=if(field2="Successful","Yes","No")
| stats values(EventCode) AS EventCode values(check) AS check dc(check) AS dc_check earliest(_time) AS _time
| search dc_check=1 check=No
| mvexpand field2
| table _time field2
in this way, you check if in your logs there's the "Successful" string:
Ciao.
Giuseppe