Splunk Search

Correlating events over specific days within a time window

splunked38
Communicator

Hi All,

I'm trying to create correlate events that have taken place on specific times/dates.

As an example:

  • We know a service has gone down around about 25th Aug at 10:05 and again on the 1st Sep 9:45
  • We believe that it happened around +/- 10 minutes of the approximate time (nothing was officially recorded, hence the best guess times)
  • We want to know what computer(s) the service went down on

Our base search is the below but we're wondering if we can build on this (or if there is a better approach)
sourcetype=ServiceSource EventTime="01.09.2013 10:0*" [search sourcetype=ServiceSource EventTime="25.08.2013 09:4*" | top limit=10 ComputerName | fields + ComputerName] | top limit=10 ComputerName

Thanks in advance.

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

For running a search on two distinct time ranges you could do something like this (on _internal for executability everywhere):

| stats count | fields - count | eval earliest = strptime("2013-11-11 11:11:11", "%Y-%m-%d %H:%M:%S").";".strptime("2013-11-12 12:12:12", "%Y-%m-%d %H:%M:%S") | makemv delim=";" earliest | mvexpand earliest | eval latest=earliest+600 | map search="search earliest=$earliest$ latest=$latest$ index=_internal | bin _time span=1d | stats count by _time host"

Starting from that, you could do analysis based on most chatty hosts.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

For running a search on two distinct time ranges you could do something like this (on _internal for executability everywhere):

| stats count | fields - count | eval earliest = strptime("2013-11-11 11:11:11", "%Y-%m-%d %H:%M:%S").";".strptime("2013-11-12 12:12:12", "%Y-%m-%d %H:%M:%S") | makemv delim=";" earliest | mvexpand earliest | eval latest=earliest+600 | map search="search earliest=$earliest$ latest=$latest$ index=_internal | bin _time span=1d | stats count by _time host"

Starting from that, you could do analysis based on most chatty hosts.

0 Karma

splunked38
Communicator

Thanks, good base search.

0 Karma

splunked38
Communicator

*NOTE: We could search by errors but we'd like to narrow down the time window rather than eliminate errors. Given the number of servers involved, reducing the search space is seen at the logical first step.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...