Splunk Operational Intelligence Cookbook - Third Edition

How to do it...

Follow the steps in this recipe to create a real-time alert when checkout errors occur:

1. Log in to your Splunk server and select the Operational Intelligence application.
2. In the Search bar, enter the following search:

index=main sourcetype=log4j  
| transaction threadId maxspan=5m  
| search requestType="checkout" result="failure"  
| stats count by requestType, threadId, sessionId,  customerId, orderId, invoice, paymentId, numberOfItems,  total, result 

3. Change the search time period to a 5-minute window by selecting 5 minute window from the real-time Presets column of the time range picker:

4. The search will run but might not ...