Alert based on seeing Message A without being followed by Message B


1 comment

  • Official comment
    Raghu Murthy

    Hi Larry,

    Do you have a way to link Message A and Message B when they do work? This could be due to a parsed field for example "id" 

    If so, you can use the transactionize operator to group all messages with the same "id" field and use the merge operator to merge the grouped messages. Then, you can apply a condition to check for the presence or absence of the two strings. You can also specify a time range for transactionize to do the grouping of messages

    Here's an example query

    ((_sourceCategory="vec/p/pss/utm") *Valtovpc* ("VPN Down" or "VPN up"))
    | parse "id=\\\"*\\\"" as id
    | transactionize id maxspan=1m (merge id takeFirst, _raw join with "\n\n" as merged_message)
    | where merged_message matches "*VPN down*" and !(merged_message matches "*VPN up*")

    Hope that helps

    Kind regards


    Comment actions Permalink

Please sign in to leave a comment.