How do i join these two events where both are true for a one minute time range?
index=BOB "No response from remote server RegistryClient "
Returns two events on host server A:
1 A - 14:59:55
2 A - 16:00:15
index=BOB "getTestRegistry remote call to ping registry failed!"
Returns multiple events on one or more of these host servers L, M, N, & O as follows:
1 LM - 5:00:25
2 LMO - 13:10:15
3 NO - 13:50:11
4 L - 14:20:19
5 M - 15:01:05
6 MN - 16:11:00
The goal is to trigger an alert on (1 A - 14:59:55) and (5 M - 15:01:05 ) as they happened within one minute of each other. All other events do not matter.
Take a look at this Q&A; you should be able to modify that solution to fit your needs:
https://answers.splunk.com/answers/232781/find-all-events-of-type-x-that-do-not-have-an-even.html
Hi MikeBertelsen,
in the two answers provided below you will get some ideas how this can be done. The first one will be about comparing events without join
or append
:
the second one will use some eval on _time
to get values from different times:
https://answers.splunk.com/answers/185829/how-to-create-a-custom-macro-function-inside-the-s.html
Also read this blog post about streamstats
which will be helpful to you:
http://blogs.splunk.com/2013/10/31/streamstats-example/
Hope this helps ...
cheers, MuS
See if this sorta pseudo code gives you what you are looking for.
index=bob "No response" | eval src=1 | append [search index="bob" "getTestRegistry" | eval src=2] | sort _time | delta _time as t p=1 | delta p=1 src | where src>0 AND t<1 minute
Hopefully, the streamstats
& delta
commands give you some ideas
index=bob "No response from remote server RegistryClient " | eval src=1 | append [search index=bob "getTestRegistry remote call to ping registry failed!" | eval src=2] | sort _time | delta _time as t p=1 | delta p=1 src | where src>0 AND t<1
did not return the desired results as far as i can tell. but thanks.
what do you get when you remove the where
clause?
I get all the desired events in reverse order same as i would get with this syntax: index=bob "No response ..." OR "getTestRegistry..."
what are the values for src
& t
? Do those look right?