topic Re: How to search for requests from the same source that happen within given time interval in Splunk Search

How to search for requests from the same source that happen within given time interval

passogiau — Tue, 09 Jun 2020 20:14:59 GMT

Greetings,

I need to search for requests from the same username that occur within certain time interval, say, less than 100ms and output various request attributes. How can the query be constructed to extract such requests?

Thanks in advance

Re: How to search for requests from the same source that happen within given time interval

bowesmana — Tue, 16 Jun 2020 06:25:25 GMT

Maybe start with something like

base search | streamstats time_window=100ms values(*) as * by user

where the field 'user' is your username field, but at this point, it very much depends on what you want to do with that data

Re: How to search for requests from the same source that happen within given time interval

DalJeanis — Wed, 17 Jun 2020 02:29:51 GMT

That's a very good start, @bowesmana. Two additions...

1) As a practice, we always include in the pseudocode a fields command to limit the junk and speed the search. If beginners learn that strategy early on, it will save them centuries of machine time. When doing values(*) as *, it's especially important.

2) streamstats is finicky with time_window, so if we're doing anything complicated, then we usually include a sort 0 to explicitly validate the event order right before the streamstats.

base search | fields _time user ... the exact fields that you want to know about ... | sort 0 _time user | streamstats time_window=101ms values(*) as * by user

I gave it 1 extra ms, since I can never remember whether streamstats is inclusive or exclusive, and with ms it might matter.

Re: How to search for requests from the same source that happen within given time interval

bowesmana — Wed, 17 Jun 2020 05:23:59 GMT

Good point @DalJeanis about the wildcards - you're right, that particular construct is not something you're ever likely to want to do on _raw data given all the additional fields you'd collect on the way, so worth pointing out.