I am working with data that is shared/backed up by two separate hosts. Each userID is linked to two hosts. When there are data issues (server outages, etc), a certain error on the host is triggered. I need to find out when the error is triggered for BOTH hosts at the same time. The error may be triggered every 5 minutes, so I need a table showing each userID, the two hosts that map to that user, and each timestamp that is within 5 seconds (due to latency timestamp may not match exactly).
Therefore, I believe I somehow need to separate the two hosts into separate fields, but am not sure the best way to do this.
The psuedo code would look like:
for each userID{
if (host1 != host2 && abs(host1.timestamp-host2.timestamp) <= 5 && host1.error==host2.error){
return (userID, host1, host2, timestamp)
}
}
Is there a way in Splunk that I can generate this table by comparing timestamps of the two hosts that are connected to the userID?
