OK, so this search is reading an input file looking for where the field ErrorCode has data populated in it.  I am trying to count the occurrences of those errors and if they are 10 or more consecutive errors I will be triggering an alert. Here is the search: | inputlookup myfile.csv | eval _time=strptime(RequestDatetime,"%F %T") | search (RequestDatetime>="2020-08-19" AND RequestDatetime<"2020-08-20") | search (InfoSourceID="3" OR InfoSourceID="4") AND ErrorCode=* | streamstats reset_after=(isnull(errorCode)) count |stats latest(eval(if(count>=10,_time,NULL))) as _time The ErrorCode field may or may not have data in it.  The requirement is to count 10 or more consecutive errors and trigger an alert.  The issue is when testing I added some blank fields to see if the reset_after line would reset the count and it did not. For example, the line on the left works fine and triggers an alert.  The one on the right triggers an alert but  I don't want it to because they are not consecutive. ErrorCode ErrorCode data data data null data data data null data data data null data data data null data data data null   data   null   data   null   data   null   data   null   data   null   data   Am I using streamstats correctly here? Thanks.       ... View more

Hello Splunkers I have an IIS log  that I am testing against and I have a need to test for a specified range The _time field in the log is formatted like this   2020-08-23T21:25:33.437-0400 2020-08-23T21:25:33.437-0400 I want to query everything between  21:25:33 and 21:25:43 2020-08-23T21:25:33.437-0400 2020-08-23T21:25:34.133-0400 2020-08-23T21:25:35.267-0400 2020-08-23T21.25:36:42.683-0400 2020-08-23T21:25:37.270-0400 2020-08-23T21:25:38.013-0400 2020-08-23T21:25:39.320-0400 2020-08-23T21:25:40.753-0400 2020-08-23T21:25:41.597-0400 2020-08-23T21:25:42.013-0400 2020-08-23T21:25:43.353-0400   So my search would look something like this.  What is the best way to do this? | where _time < blah _time >= blah ... View more

Hello Splunkers I have an IIS log I need to open and search through every 15 minutes. If I see 10 consecutive occurences of the field ErorrCode= within a five minute period I want to trigger an alert. ErrorCode=  Will be populated with different error codes like this ErrorCode=T1234.  I dont want to count individual error codes just the field ErrorCode.  I have been able to seach for occurences using alerts but the requirement if that they have to be consecutive occurences.   Here is an example snippet  ErrorCode can return several different values.  We dont care about the individual codes we just want to trigger when  the term ErrorCode appears in 10 consecutive lines of the log during a time window of 5 minutes LogTypeID="x", InfoSourceID="x", ErrorText="xxxxxxxx", ErrorCode="XXXXXX", ErrorDescription="xxxxxxxx", IISServerName="xxxxxx", CreatedDate="2020-08-14 10:19:34.557", CreatedBy="xxxxxx", MemberShipID="xxxxxx", RegisterRequestTime="2020-08-14 10:16:06.0", AppCode="xxxxxx", InvalidAppCode="xxxxxx,"   any help would be appreciated thanks John ... View more

Hello I currently get CSV results from a daily import into Splunk.  The first field is a serial number in this format INA field called "Serial Number" like this "xxx-xxx-xxx" it is the first field in the raw_data results. I have a lookup  called SerialNumber that has a series of serial numbers with the same format I want to check for in the daily report.  I have tested the lookup alone in Splunk and it works fine. It has about 20 serial numbers that I want to check for in the daily results. If there is a match just return the serial number or true index="blah" sourcetype="blah:csv" [ | inputlookup SerialNumber ] fields  thanks for your help     ... View more