Splunk Search

Whats the best way to classify events as being "Normal" or "Exception" type of events based on time ranges when i have various different exception windows timings?

magenta
New Member

I have historical events that i'm looking to classify as having occurred during an exception period or not.
The challenge is that there are 12+ categories of events and each type of event has 4 slightly different "Exception Periods" each year. For some of the categories, the exceptional time period can be defined based on # of work days before and after the end of the quarter.

Is there a good way of doing this outside of writing many many IF statements?

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You could write a time-based lookup with three columns: _time, category, period

For each category, you'd put in a row for each transition between normal and exception, along with the timestamp for the transition and the class that started then. The time-based lookup logic should retrieve the youngest row for each event's category that's still before the event's timestamp.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could write a time-based lookup with three columns: _time, category, period

For each category, you'd put in a row for each transition between normal and exception, along with the timestamp for the transition and the class that started then. The time-based lookup logic should retrieve the youngest row for each event's category that's still before the event's timestamp.

0 Karma

magenta
New Member

Thanks i didn't realize lookups could be time based so i think this should work!

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...