Splunk Search

If Then? Can this be done with Splunk

pwjohnston79
New Member

First off, I’m not very strong in the scripting so If Then might not even be what I need to use. I thought Splunk just searched for errors, but I’ve been told to search for this.

I have a process that spits out a log with this entry
ApprovalExecutionJob:22 - BEGIN::Processing Approval Requests
It runs ever 15 min (0,15,30,45).

It takes about 5 min and then spit out this:
ApprovalExecutionJob:37 - END::Processing Approval Requests

If it does not produce this END process notice then we need to be notified. Can this be done in Splunk?

Tags (1)
0 Karma

lukejadamec
Super Champion

If What > What Then. You need something in the logs that links the two events. Your example of events does not show a link.

0 Karma

kphillipson
Path Finder

I have asked a question like this one. This might be of use.
http://answers.splunk.com/answers/84271/transaction-two-logs-alert-if-orphaned-for-30-mins

0 Karma

kristian_kolb
Ultra Champion

Yes, it can probably be performed in some way or another. Is the '22' and '37' some unique job ID's (or at least unique enough for the purpose of the search, e.g. do not repeat more than daily)? Then you can search like this;

sourcetype=your_sourcetype | rex "ApprovalExecutionJob:(?\d+)" | stats count by JobID | where count < 2

There are other options like e.g. transaction which may also be useful.

/K

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...