Knowledge Management

is there a search condition to get a burst of events in certain short time period?

leonjxtan
Path Finder

I wanted to catch burst of events reaching certain threshold in a short period time. I think splunk must have this function but no luck finding it. Could you please point me to the doc?

I imagine the search would look like:

sourcetype=foo condition1=xxx condition2=yyy |where event count within 5 seconds > 100
Tags (1)
0 Karma
1 Solution

leonjxtan
Path Finder

got it solved finally. The answer is transaction.
reference: https://docs.splunk.com/Documentation/Splunk/6.5.3/Search/Identifyandgroupeventsintotransactions

sourcetype=foo condition1=xxx condition2=yyy |transaction field1 field2 field3 maxspan=5s maxpause=1s |where eventcount>100

Then you will see the events themselves.

View solution in original post

0 Karma

leonjxtan
Path Finder

got it solved finally. The answer is transaction.
reference: https://docs.splunk.com/Documentation/Splunk/6.5.3/Search/Identifyandgroupeventsintotransactions

sourcetype=foo condition1=xxx condition2=yyy |transaction field1 field2 field3 maxspan=5s maxpause=1s |where eventcount>100

Then you will see the events themselves.

0 Karma

ctaf
Contributor

Hi,

You could use the trendline command which will compute "moving average":

sourcetype=foo condition1=xxx condition2=yyy  | timechart count span=1s | trendline sma5(count) as moving_count_events
| eval burst=if(count> 2 * moving_count_events, 9999999, 0)

Then, you can filter with where command:

... | where burst=9999999
0 Karma

leonjxtan
Path Finder

Thanks so I searched with your suggested query, it seems good but it returns a table. How can I modify it to make it return events themselves?

sourcetype=foo condition1=xxx condition2=yyy  | timechart count span=1s | trendline sma5(count) as moving_count_events |where burst=9999999
0 Karma

ctaf
Contributor

You can try replacing timechart by streamstats :

sourcetype=foo condition1=xxx condition2=yyy | streamstats count time_window=1s| trendline sma5(count) as moving_count_events |where burst=9999999

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...