topic Re: Filter events in a time frame by a condition in Splunk Search

Filter events in a time frame by a condition

RemyaT — Sun, 12 Nov 2023 09:07:29 GMT

I have the query to find the response code and count vs time (in 1 minute time interval) as below.

index=sample_index path=*/sample_path* | bucket _time span=1m | stats count by _time responseCode

The result shows the response code and count vs time for each minute. But I just need the events in those 1 minutes which have 403 response code along with other response codes and skip which doesn't have 403.

Suppose during time1, if there are only events with response code 200, I don't need that in my result. But during time2, if there are events with response code 200 and 403, I need that in the result as time, response code, count.

Re: Filter events in a time frame by a condition

gcusello — Sun, 12 Nov 2023 09:18:46 GMT

Hi @RemyaT,

let me understand: do you want to count only events with response_code=403 or cout of all response_codes when there's at least one 403?

If the first, you can try:

index=sample_index path=*/sample_path* response_code=403 | timechart span=1m count

if the second

index=sample_index path=*/sample_path* | bucket _time span=1m | stats count(eval(response_code="200")) AS 200_count count(eval(response_code="403")) AS 403_count BY _time | where 403_count >0

Ciao.

Giuseppe

Re: Filter events in a time frame by a condition

ITWhisperer — Sun, 12 Nov 2023 09:53:44 GMT

index=sample_index path=*/sample_path* responseCode=200 OR responseCode=403 | timechart span=1m count by responseCode | where '403' > 0