Splunk Search

Splunk search logs

ramanapvr
New Member

Am having log entries as per below.

In essence, we have to detect a line with “Task started. Task id - 'number' an save the number for task id.
Then we have to detect another line with “Task completed. Task id - 'number' and the same number.

'number' will be keep changing in logs, so we have to scann the 'number' and then alert if start or stop is failed. Can i have query which will meet the requirement.

If we find those two lines without any error logs in between, then we are good. If there are ERROR logs in between then we have to raise an alarm.

Tags (3)
0 Karma

jeffland
SplunkTrust
SplunkTrust

If you want something like your number for further use, you should extract it as a field. If this is a sporadic need, you may want to do a search with the command rex in it, which should look something like

your search so far | rex "Task id - '(?<number>\d+)'" | table number

(provided the single quotes around number are present in your logs, if not remove them from the command). That will enable you to use a field with the name "number" just like any other field such as host or sourcetype, as I did with table above.

If this is needed more frequently, you may want to do this with automatic field extractions - simply use the same regular expression as above use Settings - Fields - Field Extractions. If you don't know what fields are, start here.

Regarding how you from there get to what you need in the end, you might be interested in transaction. I'm thinking of something like

... | transaction number startswith="Task started" endswith="Task completed"

and from there search for your error logs to raise alarms.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...