First off, I’m not very strong in the scripting so If Then might not even be what I need to use. I thought Splunk just searched for errors, but I’ve been told to search for this.
I have a process that spits out a log with this entry
ApprovalExecutionJob:22 - BEGIN::Processing Approval Requests
It runs ever 15 min (0,15,30,45).
It takes about 5 min and then spit out this:
ApprovalExecutionJob:37 - END::Processing Approval Requests
If it does not produce this END process notice then we need to be notified. Can this be done in Splunk?
If What > What Then. You need something in the logs that links the two events. Your example of events does not show a link.
I have asked a question like this one. This might be of use.
http://answers.splunk.com/answers/84271/transaction-two-logs-alert-if-orphaned-for-30-mins
Yes, it can probably be performed in some way or another. Is the '22' and '37' some unique job ID's (or at least unique enough for the purpose of the search, e.g. do not repeat more than daily)? Then you can search like this;
sourcetype=your_sourcetype | rex "ApprovalExecutionJob:(?
There are other options like e.g. transaction
which may also be useful.
/K