https://community.splunk.com/t5/Splunk-Search/How-to-do-a-time-based-search-for-router-logs/m-p/364641#M107569 <P>we have 6.5.2, so will give it a try, thanks for the reply.</P> Fri, 17 Mar 2017 19:03:12 GMT salmanrc 2017-03-17T19:03:12Z https://community.splunk.com/t5/Splunk-Search/How-to-do-a-time-based-search-for-router-logs/m-p/364639#M107567 <P>Hello,<BR /> I am new to Splunk, so trying to get familiarize with it. I want to do a time based search for router logs, for example.</P> <P>I have a Syslog A and a syslog B. Trying to do a search such that the search should show results if Syslog B occurred within 60 mins of Syslog A.</P> <P>Any help is appreciated. thanks</P> Thu, 16 Mar 2017 14:37:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-do-a-time-based-search-for-router-logs/m-p/364639#M107567 salmanrc 2017-03-16T14:37:47Z https://community.splunk.com/t5/Splunk-Search/How-to-do-a-time-based-search-for-router-logs/m-p/364640#M107568 <P>what version of Splunk are you on? 6.5 has a new option for <CODE>streamstats</CODE> called <CODE>time_window</CODE> that allows you to look at a window of time (in your case, 1 hour) and you can group events together that way.</P> <P>maybe something like (depending on your data): <CODE>|sort 0 _time|streamstats values(syslogA) as syslogA by syslogB time_window=60m</CODE> </P> <P><A href="https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Streamstats">https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Streamstats</A></P> Thu, 16 Mar 2017 17:25:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-do-a-time-based-search-for-router-logs/m-p/364640#M107568 cmerriman 2017-03-16T17:25:10Z https://community.splunk.com/t5/Splunk-Search/How-to-do-a-time-based-search-for-router-logs/m-p/364641#M107569 <P>we have 6.5.2, so will give it a try, thanks for the reply.</P> Fri, 17 Mar 2017 19:03:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-do-a-time-based-search-for-router-logs/m-p/364641#M107569 salmanrc 2017-03-17T19:03:12Z