Search for message NOT followed by another message

Comments

4 comments

  • Avatar
    Mario Sanchez

    Wayne,

    Here's something that can help. Assuming that you can have multiple messages A and B in the same minute:

    *
    | timeslice 1m
    | if (message=A, 1, 0) as msg_A
    | if (message=B, 1, 0) as msg_B
    | sum(msg_A) as A_count, sum(msg_B) as B_count by _timeslice, src_ip
    | sort by _timeslice, src_ip
    //| where A_count > B_count

    This query will provide a count of A's and B's by 1 minute slices and IP address. Uncommenting the last line will only give you results when your count of A's is greater than B's.  You can then set your Alert with the following Alert condition:

    Send notification only if the condition below is satisfied:

    Number of results Greater than > 0

     

    hope this helps.

    Mario

     

    0
    Comment actions Permalink
  • Avatar
    Abdul-Qaadir Sulayman

    Hi Mario,

     

    Ive looked at this query and tried to apply it to my current and similar situation,

    It works to a point and I want to be able to output the results on a dashboard.

    Here is my current limitation or I should say something I am stuck with,

     

    I've got two messages that is tied to one transaction - a request and response. When the request and response are present I do a check on the response to see if the result is accepted or not accepted in the response and then count the accepts and rejects. However when there is no response this is seen as a failure however applying the above query to this scenario is proving to be difficult, as the request is available but there is no response which means I have no other message to look at for a final result.

     

    Can you kindly and urgently assist :)

     

    Kind Regards,

    Abdul 

    0
    Comment actions Permalink
  • Avatar
    Mario Sanchez

    Abdul,

    Keep in mind that the query above only looks for a count of requests and responses, it does not look for the content of the response. If I understand your question (or issue) correctly, what you need to do is parse the response to see if it is an Accept or a Reject. In your scenario, what should happen if there is no response to a request? Should this trigger an Alert?

    0
    Comment actions Permalink
  • Avatar
    Abdul-Qaadir Sulayman

    When there is no response to a request, I want to count all requests that have no response and display the results on a dashboard. So I would have a graph displaying 1. Success 2. Decline 3. Failure

     

    I have used transactionize but the problem comes in when I want to view the dashboard in live mode (Transactionize not supported) Ive had to recreate my query again.

    I know the solution to my problem is quite simple however it has been challenging getting this to take form using the Sumo search operators and very basic regex (I'm trying not to over complicate things)

     

    Apologies for the delay in reply,

    0
    Comment actions Permalink

Please sign in to leave a comment.