Knowledge Management

is there a search condition to get a burst of events in certain short time period?

leonjxtan
Path Finder

I wanted to catch burst of events reaching certain threshold in a short period time. I think splunk must have this function but no luck finding it. Could you please point me to the doc?

I imagine the search would look like:

sourcetype=foo condition1=xxx condition2=yyy |where event count within 5 seconds > 100
Tags (1)
0 Karma
1 Solution

leonjxtan
Path Finder

got it solved finally. The answer is transaction.
reference: https://docs.splunk.com/Documentation/Splunk/6.5.3/Search/Identifyandgroupeventsintotransactions

sourcetype=foo condition1=xxx condition2=yyy |transaction field1 field2 field3 maxspan=5s maxpause=1s |where eventcount>100

Then you will see the events themselves.

View solution in original post

0 Karma

leonjxtan
Path Finder

got it solved finally. The answer is transaction.
reference: https://docs.splunk.com/Documentation/Splunk/6.5.3/Search/Identifyandgroupeventsintotransactions

sourcetype=foo condition1=xxx condition2=yyy |transaction field1 field2 field3 maxspan=5s maxpause=1s |where eventcount>100

Then you will see the events themselves.

0 Karma

ctaf
Contributor

Hi,

You could use the trendline command which will compute "moving average":

sourcetype=foo condition1=xxx condition2=yyy  | timechart count span=1s | trendline sma5(count) as moving_count_events
| eval burst=if(count> 2 * moving_count_events, 9999999, 0)

Then, you can filter with where command:

... | where burst=9999999
0 Karma

leonjxtan
Path Finder

Thanks so I searched with your suggested query, it seems good but it returns a table. How can I modify it to make it return events themselves?

sourcetype=foo condition1=xxx condition2=yyy  | timechart count span=1s | trendline sma5(count) as moving_count_events |where burst=9999999
0 Karma

ctaf
Contributor

You can try replacing timechart by streamstats :

sourcetype=foo condition1=xxx condition2=yyy | streamstats count time_window=1s| trendline sma5(count) as moving_count_events |where burst=9999999

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...