topic Re: Looking for new events in Splunk Search

Looking for new events

richnavis — Fri, 06 May 2016 18:57:26 GMT

Good Day Everyone,

I"m trying to construct a search that will search our weblogs over a one hour period and report on IP addresses that didn't appear in the first half hour. I would like to display the sum of new IPs in a timechart. The approach I'm started to take is to search the hour, create 1 minute buckets, group by IP address, and add a column that indicates if it was first half or second half of the hour so the data now looks something like this..
Time IP &nbsp Count Group
08:00 10.10.10.10 20 First
08:01 10.10.10.10 27 First
08:00 10.10.10.11 3 First
.....
08:32 10.10.10.11 79 Second
08:33 10.10.10.14 11 Second
08:34 10.10.10.14 44 Second
...

So, now I'm trying to Create a TimeChart that includes ALL values from first group, and ONLY IPs in the second group that aren't included in the first group. This is where I'm stumped.

Re: Looking for new events

jensonthottian — Fri, 06 May 2016 19:11:54 GMT

This should give you result from group 2 avoiding IP's from first group.

Re: Looking for new events

woodcock — Sat, 07 May 2016 15:30:49 GMT

Like this:

... | eval date_minute = strftime(_time, "%M") | eval FirstOrSecond=if((date_minute>=30), "Second", "First") | eventstats dc(FirstOrSecond) AS numHalves BY IP | where FirstOrSecond="First" OR (FirstOrSecond="Second" AND numHalves=1) | timechart ...