Hello,
I am new to Splunk, so trying to get familiarize with it. I want to do a time based search for router logs, for example.
I have a Syslog A and a syslog B. Trying to do a search such that the search should show results if Syslog B occurred within 60 mins of Syslog A.
Any help is appreciated. thanks
what version of Splunk are you on? 6.5 has a new option for streamstats
called time_window
that allows you to look at a window of time (in your case, 1 hour) and you can group events together that way.
maybe something like (depending on your data): |sort 0 _time|streamstats values(syslogA) as syslogA by syslogB time_window=60m
https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Streamstats
we have 6.5.2, so will give it a try, thanks for the reply.