Hi all,
I'm fairly new to splunk and was wondering if someone could point me in the direction I need to go. I'm having trouble with making searches that will show when event A occurs and then event B occurs after within a time frame. The after part is crucial as the inverse occurrence is less important to us.
Some examples:
I don't need help formulating the pieces of the search, such as how to find if there are 100 blocked sites or if a file was downloaded. The bigger issue is how do I say if event A and after event B occurs within a specific time range.
Thanks,
Kim
The join
command can be used to combine the results of two searches - and to restrict the time-ordering. Usually I suggest that people try to combine searches and avoid join, since it can be slow.
But for this situation, the join
command might be helpful and easier than something like delta
. This kind of search might do what you want...
index=antivirus "malware event"
| join host usetime=T earlier=F [ search index=proxy "blocked event"
| stats count earliest(_time) as _time by host
| where count > 100 ]
The join
command can be used to combine the results of two searches - and to restrict the time-ordering. Usually I suggest that people try to combine searches and avoid join, since it can be slow.
But for this situation, the join
command might be helpful and easier than something like delta
. This kind of search might do what you want...
index=antivirus "malware event"
| join host usetime=T earlier=F [ search index=proxy "blocked event"
| stats count earliest(_time) as _time by host
| where count > 100 ]
You can use delta command on _time field to calculate time difference between two events. Once you filter the events you need and calculate time difference, (+ve time diff means they occurred after each other) and do more processing. More details of search/data will be helpful here to provide more to the point answers.