Splunk Search

compare time field of the same type of message and raise an alert

pbao9801
New Member

8/1/19
8:58:38.084 PM

{"log":"| loglevel=\"INFO\" | thread=\"yyyyy\" | logger=\"xxxxx\" | message=\"Purely informational message\" | status=\"INFORMATIONAL\" | code=\"00002\" | Received=\"1000\" | reason=\"ABC Log\" | All Matching Count=\"29\" | Yawl Code KEY=\"INFORMATIONAL\" | Count=\"36\" \n","stream":"stdout","time":"2019-08-01T20:58:38.084436889Z"}

8/1/19
7:58:38.083 PM

{ [-]
log: | loglevel="INFO" | thread="yyyyy" | logger="xxxxx" | message="Purely informational message" | status="INFORMATIONAL" | code="00002" | Received="1000" | reason="ABC Log" | All Matching Count="29" | Yawl Code KEY="INFORMATIONAL" | Orderline Count="36"

These are information of the same type of message. How do I compare the time difference of the 2 messages above and raise an alert if the 2 message not arrive or above 30 minutes? These message are about an hour apart so it should raise an alert

Tags (1)
0 Karma

pbao9801
New Member

cut and paste and missing the time in the second message: it is the same type of format like the first one but an hour earlier "\n","stream":"stdout","time":"2019-08-01T20:58:38.084436889Z"

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...