About alexm2a

alexm2a · ‎09-05-2022

Hi Giuseppe, thank you for your assistance. When I try that I get no results even though I can see a job more than 4 hours ago that had a start but no end has happened. If I remove the | where eventcount=1 AND event_name="process.start" and use | table event_name, jobId I cannot see my stuck jobId in the list Seems like the transaction is removing the event that does not have a process.end Any ideas? Many thanks Alex

alexm2a · ‎09-03-2022

Hi there, I have 2 messages that log when a job is run, which share a job_id field event_name=process.start event_name=process.end I'm trying to create an alert that fires if there is an event_name=process.start , but no event_name=process.end , after 3 hours. I've seen lots of examples of using transactions between 2 events to get the duration, but not any if an event is missing. Many thanks, apologies if this is a noob question

alexm2a · ‎02-27-2018

This is soooooo helpful! Thank you very much!

alexm2a · ‎02-26-2018

Having thought about this a bit more, i believe the first step would be to find all the duplicate channels for that day using event_data.day , then work from there. If only i know how to do that. Sort of like a negative dedup... I've tired | where event_data.channel=event_data.channel but that doesn't work

alexm2a · ‎02-26-2018

Hi there, Apologies in advance for this question. I'm a beginner learning Splunk and I can't for the life of me figure out how the syntax for this would look. I have multiple sets of data a bit like this: activity_id: 1131c134-d771-41e7-918d-d42772fc1316 date_time: 2018-02-13T08:21:40.682844+00:00 env: prod event_data: { [-] channel: 1124 day: 2018-02-18 eventId: 97356218 streamEndDateTime: 1518974100000 streamStartDateTime: 1518965640000 } event_name: update.event timestamp: 1518510100682 And I need a query that will check whether 2 or more events will clash based on the event_data.channel and the event_data.streamEndDateTime and event_data.streamEndDateTime . So if the event_data.channel AND event_data.streamStartDateTime is in the range between event_data.streamStartDateTime and event_data.streamEndDateTime of a matching event_data.channel , then show results. Any help would be greatly appreciated.

alexm2a · ‎02-13-2018

Brilliant! Thank you!

alexm2a · ‎02-13-2018

Hi there, I have some data like this activity_id: 1131c134-d771-41e7-918d-d42772fc1316 date_time: 2018-02-13T08:21:40.682844+00:00 env: prod event_data: { [-] channel: 1124 day: 2018-02-18 eventId: 97356218 streamEndDateTime: 1518974100000 streamStartDateTime: 1518965640000 } event_name: update.event timestamp: 1518510100682 And I would like Splunk to generate a report each day at midnight based on the next 2 days from the 'event_data.day' value. For example if today is 2018-02-17, the report would check event_name="update.event" event_data.day="2018-02-17" OR event_data.day="2018-02-18" The next day the report would check for event_name="update.event" event_data.day="2018-02-18" OR event_data.day="2018-02-19" etc. Any help would be greatly appreciated.

Posts	7
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎02-13-2018

Online Status	Offline
Date Last Visited	‎09-07-2022 11:32 AM

How to use time elapsed after an event and a missi...

check for clashing events on a channel

generate daily report on date field in data

Re: Time elapsed after an event and a missing even...

How to use time elapsed after an event and a missi...

Re: check for clashing events on a channel

Re: check for clashing events on a channel

check for clashing events on a channel

Re: generate daily report on date field in data

generate daily report on date field in data