Deployment Architecture

How can I search for two different error messages to see if they both happened in a one-minute timespan?

svemurilv
Path Finder

I have 2 sourcetypes. For each sourcetype having different error messages, how can I search those 2 different error messages to see if they happened in a bucket of 1 minute timespan?

sourcetyep=first OR sourcetyep=second_one ErrorMessage="timeout" OR ErrorMessage="brokenPipe" |bucket _time span=1m
0 Karma

DalJeanis
Legend

Here's one way

( sourcetype=first OR sourcetype=second_one) (ErrorMessage="timeout" OR ErrorMessage="brokenPipe") 
| sort 0 _time
| streamstats time_winidow=60s values(ErrorMessage) as ErrorMessage 
| where mvcount(ErrorMessage) >1 

svemurilv
Path Finder

i have change a logic that both the conditions was happened in a bucket of time 1 min , still its not working,

(sourcetype=nginx:apierror ErrorMessage="connect() failed (111: Connection refused) while connecting to upstream") AND (sourcetype=nginx:nginxerror ErrorMessage="open()*No such file or directory)") | streamstats time_window=60s values(ErrorMessage) as ErrorMessage| where mvcount(ErrorMessage) >1

0 Karma

LCM_BRogerson
Path Finder

Replace the AND with an OR in your search
(sourcetype=nginx:apierror ErrorMessage="connect() failed (111: Connection refused) while connecting to upstream") OR (sourcetype=nginx:nginxerror ErrorMessage="open()*No such file or directory)")

Your search will return events with (values A B) AND (values C D). Instead I think you want events with (values A B) OR (values C D)

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...