topic Re: evaluate time range in splunk event data and alert in Alerting

evaluate time range in splunk event data and alert

GEB — Wed, 08 Dec 2021 20:58:17 GMT

Given an event log specification of:
"{DateTime} Times:
Online_1: CNCT_TM: {CNCT_TM}; LOG_TM: {LOG_TM}
Online_2: CNCT_TM: {CNCT_TM}; LOG_TM: {LOG_TM}
Offline_1: CNCT_TM: {CNCT_TM}; LOG_TM: {LOG_TM}
Offline_2: CNCT_TM: {CNCT_TM}; LOG_TM: {LOG_TM}"

which is logged 4 times a day and an example entry like:
"2021-12-08 14:31:59 Times: Online_1: CNCT_TM: 2021-12-08 14:47:13.873; LOG_TM: 2021-12-08 14:47:16.387; Online_2: CNCT_TM: 2021-12-08 14:47:49.837; LOG_TM: 2021-12-08 14:47:50.480; Offline_1: CNCT_TM: 2021-12-08 14:48:27.303; LOG_TM: 2021-12-08 14:48:28.927; Offline_2: CNCT_TM: 2021-12-08 14:48:56.673; LOG_TM: 2021-12-08 14:48:58.750"

How do I evaluate and graph the time range in Minutes and Seconds (just seconds would be fine for me) between the maximum and minimum times embedded in the 8 times captured in the log entry? Ultimately, I would like to create an alert if a time range greater than something like 30 minutes were to occur.

Re: evaluate time range in splunk event data and alert

ITWhisperer — Wed, 08 Dec 2021 22:34:44 GMT

| makeresults | eval _raw="2021-12-08 14:31:59 Times: Online_1: CNCT_TM: 2021-12-08 14:47:13.873; LOG_TM: 2021-12-08 14:47:16.387; Online_2: CNCT_TM: 2021-12-08 14:47:49.837; LOG_TM: 2021-12-08 14:47:50.480; Offline_1: CNCT_TM: 2021-12-08 14:48:27.303; LOG_TM: 2021-12-08 14:48:28.927; Offline_2: CNCT_TM: 2021-12-08 14:48:56.673; LOG_TM: 2021-12-08 14:48:58.750" | rex max_match=0 "_TM:\s(?<timestamp>[^;]+)" | eval timestamp=mvmap(timestamp,strptime(timestamp,"%Y-%m-%d %H:%M:%S.%Q")) | eval earliest=mvindex(mvsort(timestamp),0) | eval latest=mvindex(mvsort(timestamp),-1) | eval timespan=latest-earliest

Re: evaluate time range in splunk event data and alert

GEB — Thu, 09 Dec 2021 14:51:46 GMT

Sending thanks to ITWhisperer