Deployment Architecture

How can I search for two different error messages to see if they both happened in a one-minute timespan?

svemurilv
Path Finder

I have 2 sourcetypes. For each sourcetype having different error messages, how can I search those 2 different error messages to see if they happened in a bucket of 1 minute timespan?

sourcetyep=first OR sourcetyep=second_one ErrorMessage="timeout" OR ErrorMessage="brokenPipe" |bucket _time span=1m
0 Karma

DalJeanis
Legend

Here's one way

( sourcetype=first OR sourcetype=second_one) (ErrorMessage="timeout" OR ErrorMessage="brokenPipe") 
| sort 0 _time
| streamstats time_winidow=60s values(ErrorMessage) as ErrorMessage 
| where mvcount(ErrorMessage) >1 

svemurilv
Path Finder

i have change a logic that both the conditions was happened in a bucket of time 1 min , still its not working,

(sourcetype=nginx:apierror ErrorMessage="connect() failed (111: Connection refused) while connecting to upstream") AND (sourcetype=nginx:nginxerror ErrorMessage="open()*No such file or directory)") | streamstats time_window=60s values(ErrorMessage) as ErrorMessage| where mvcount(ErrorMessage) >1

0 Karma

LCM_BRogerson
Path Finder

Replace the AND with an OR in your search
(sourcetype=nginx:apierror ErrorMessage="connect() failed (111: Connection refused) while connecting to upstream") OR (sourcetype=nginx:nginxerror ErrorMessage="open()*No such file or directory)")

Your search will return events with (values A B) AND (values C D). Instead I think you want events with (values A B) OR (values C D)

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...