How do i join these two events where both are true for a one minute time range?
index=BOB "No response from remote server RegistryClient "
Returns two events on host server A:
1 A - 14:59:55
2 A - 16:00:15
index=BOB "getTestRegistry remote call to ping registry failed!"
Returns multiple events on one or more of these host servers L, M, N, & O as follows:
1 LM - 5:00:25
2 LMO - 13:10:15
3 NO - 13:50:11
4 L - 14:20:19
5 M - 15:01:05
6 MN - 16:11:00
The goal is to trigger an alert on (1 A - 14:59:55) and (5 M - 15:01:05 ) as they happened within one minute of each other. All other events do not matter.
Take a look at this Q&A; you should be able to modify that solution to fit your needs:
in the two answers provided below you will get some ideas how this can be done. The first one will be about comparing events without
the second one will use some eval on
_time to get values from different times:
Also read this blog post about
streamstats which will be helpful to you:
Hope this helps ...
See if this sorta pseudo code gives you what you are looking for.
index=bob "No response" | eval src=1 | append [search index="bob" "getTestRegistry" | eval src=2] | sort _time | delta _time as t p=1 | delta p=1 src | where src>0 AND t<1 minute
delta commands give you some ideas
index=bob "No response from remote server RegistryClient " | eval src=1 | append [search index=bob "getTestRegistry remote call to ping registry failed!" | eval src=2] | sort _time | delta _time as t p=1 | delta p=1 src | where src>0 AND t<1
did not return the desired results as far as i can tell. but thanks.
what do you get when you remove the
I get all the desired events in reverse order same as i would get with this syntax: index=bob "No response ..." OR "getTestRegistry..."
what are the values for
t? Do those look right?