topic Re: Search in logs if value appeared before in Splunk Search

Search in logs if value appeared before?

suspense — Mon, 20 Mar 2023 17:57:32 GMT

Hello, Good Day!

I have mail logs and I need to check if sender appeared before in last 30 days.

I have issues with write SPL with join or subsearch.

index=* sourcetype=maillogs

field that I want to compare is sender. If sender appeared in last 30 mails, then I have match and I should see those events in stats or table.
I tried subsearch but after all attempts I ended with nothing. Could you please help me?

Re: Search in logs if value appeared before

ITWhisperer — Mon, 20 Mar 2023 08:36:39 GMT

| eventstats count by sender | where count > 1

Re: Search in logs if value appeared before

suspense — Mon, 20 Mar 2023 08:41:20 GMT

Thanks. What I need is to search within logs last 24 hrs and check if sender which appeared in such logs appared before within last 30 days (but without the latest 5 days)

index=* sourcetype=maillogs
| eventstats count by sender
| where count > 1
| rest of my SPL

Where to put earliest=-30d@d latest=-5d@d ?

Re: Search in logs if value appeared before

ITWhisperer — Mon, 20 Mar 2023 09:06:45 GMT

Try something like this

index=* sourcetype=maillogs (earliest=-30d@d latest=-5d@d) OR (earliest=-24h) | eventstats earliest(_time) as earliest_time latest(_time) as latest_time by sender | where earliest_time < relative_time(now(),"-24h") AND latest_time >= relative_time(now(),"-24h")