Alerting

How to alert on conditions across multiple events and include the entire file in the email, not just the line with the error?

jwinderDDS
Path Finder

I have an application that generates logs that are not always in a consistent format. Also each time a process in this application executes it creates a whole new log file for that one execution.

I am running into a couple issues:
1) If I setup an alert to send an email anytime "error*" is found in one of these files, we would like the entire file included in the email, not just the line with the error. These alerts need to be filtered based on other information in the log file, such as only alert on "error*" if "something else" is not in the file.
2) I tried solving this by treating the entire file as a single event, but can't seem to make that happen because of the way the application opens, writes, then closed the log files multiple times.

So how can I search for error* in each event, but include the entire source in the alert email, or am I going about this wrong?

Thank you!

Jeremy

0 Karma
1 Solution

woodcock
Esteemed Legend

Try this:

error* | dedup source | map search = "source=$source$"

View solution in original post

0 Karma

woodcock
Esteemed Legend

Try this:

error* | dedup source | map search = "source=$source$"
0 Karma

jwinderDDS
Path Finder

Thank you!

This gave me the 'map search=' command I needed.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...