Deployment Architecture

How can I search for occurrences of A where B does not occur within a certain number of lines in the same log?

sihtiadmin
Engager

We're troubleshooting a problem with our web app where a synchronous job queue stops executing after an indeterminate amount of uptime, requiring the app to be restarted. We think we've found the culprit after discovering a couple of instances where a particular job appears to have gotten stuck, and never logged its completion, which seems to coincide with two recent occurrences of the problem (normal logging continues, except for these queued jobs). How can I get Splunk to return a collection (transaction?) of a certain number of lines in the log starting with search string A (the message that indicates the beginning of the job), but only where that sequence of lines does not also contain search string B (the message that confirms successful completion of the job)?

0 Karma

sihtiadmin
Engager

This seems to have done the trick:

transaction startswith="A" maxevents=1000   | search NOT "B"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...