topic Re: Frequency correlation between different sourcetypes in Splunk Search

Frequency correlation between different sourcetypes

nl_cape — Tue, 12 Nov 2013 17:07:31 GMT

I have two sourcetypes, one containing alerts from users that we have a problem, and another one with server logs. In a first stage, I would like to correlate the number of exceptions and the number of alerts received. I'm struggling with how to implement this, however. I tried starting from (sourcetype="Alerts") OR (sourcetype="ExceptionLog" level="Warning" OR level="Error") | bin _time span=3h. So, I would like to get the number of alerts in a bucket, and associate it with the number of exceptions in the same bucket, but how? I read http://blogs.splunk.com/2012/10/01/simple-correlation-in-splunk, but didn't seem to work for my case.

Re: Frequency correlation between different sourcetypes

jtrucks — Tue, 12 Nov 2013 17:34:09 GMT

What is your end goal? Are you trying to compare counts, or are you trying to correlate each Alerts event with an ExceptionLog event? Why are you putting it into a bucket specifically rather than simply working with search results? (Not that using a bucket is bad, but I am just looking for your thought process and reasoning so we can help you more.)

Re: Frequency correlation between different sourcetypes

lguinn2 — Tue, 12 Nov 2013 19:16:57 GMT

Try this

 (sourcetype="Alerts") OR (sourcetype="ExceptionLog" level="Warning" OR level="Error") 
| bucket _time span=1d
| stats count(eval(sourcetype="Alerts")) as Alerts count(eval(sourcetype="ExceptionLog")) as Exceptions by host _time

As @jtrucks pointed out, you didn't give any criteria for correlating the two sets of events, so I did it by host and day.

Re: Frequency correlation between different sourcetypes

nl_cape — Wed, 13 Nov 2013 07:47:14 GMT

Interesting, that is precisely what I tried. What happens is that I get no results from count(sourcetype="AnySource"). I even tried sourcetype!="Alerts"), and I still get a count of zero. Removing the stats command, or removing the sourcetype, works as expected.

Re: Frequency correlation between different sourcetypes

nl_cape — Wed, 13 Nov 2013 07:48:57 GMT

@jtrucks: The first idea is to explore if there is a correlation between user alerts and exceptions we log. I'd like to do a scatter plot of this over time, which should hopefully make this somewhat clear.

Re: Frequency correlation between different sourcetypes

nl_cape — Wed, 13 Nov 2013 08:03:48 GMT

Ah. Changing it to count(eval(sourcetype="Alerts")) makes it work. As is clearly written in the docs. Whoops.

Re: Frequency correlation between different sourcetypes

lguinn2 — Thu, 14 Nov 2013 05:57:31 GMT

Aww, raspberry to me! I will fix the answer - thanks.