I'm a new Splunk user that needs to perform some analysis on a set of logs with the following format: Status, Starttime, Endtime, JobID, ReturnCode START,2021-03-15 10:56:15, ,123, END,2021-03-15 10:56:15,2021-03-15 10:56:27,123,0 ... For a single job, there are separate START and END logs which can be paired together by matching the start time and job ID using the 'transactions' command. When indexing these logs in Splunk, we've been parsing the Starttime field (2nd comma delimited value) as our timestamp but this means that all log entries with the 'END' status have a _time field corresponding to their start time rather than their end time. This leads to some extra work when filtering entries by time or calculating duration of jobs since we have to parse the Endtime field at search time. Is there any way to add some sort of condition which allows us to index a different timestamp field depending on the 'Status' field of an individual log? (i.e. if Status=START, take _time=Starttime but if Status=END, take _time=Endtime) ... View more

I have some field value 'foo' and I want to trigger an alert of a different severity depending on its value (e.g a low severity alert when foo > 10, a medium severity alert when foo > 20, and a high severity alert when foo > 50). I know that this is easy to do by creating separate alerts and changing the count condition and severity for each one, but this feels inefficient and will be a pain to go through and edit when the conditions change. I'm new to Splunk so I'm not aware of a way to trigger an alert with a condition for its severity. Is this possible to achieve? ... View more