Getting Data In

How to extract only the values that has the same timestamp from two different fields in a range of time PLEASE HELP ME!!!

danielgp89
Path Finder

Hello!

I have events from two different fields that are correlate each other by the time.

So I want to make a table extracting only those values that were generate at the same time from a range of time of one day.

For example in the table below, there are two values that has the same time:

How can I extract the events that only has the same timestamp from those two fields (MSGNUM=SVM4000I and SVM4874I)

alt text

0 Karma
1 Solution

renjith_nair
Legend

@danielgp89,

Try this and verify if its working for you

"your base search"|eventstats dc(MSGNUM) as c by _time|where c>1

This should result only those events which has at least 2 MSGNUM values of same time

---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:

View solution in original post

0 Karma

renjith_nair
Legend

@danielgp89,

Try this and verify if its working for you

"your base search"|eventstats dc(MSGNUM) as c by _time|where c>1

This should result only those events which has at least 2 MSGNUM values of same time

---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:
0 Karma

danielgp89
Path Finder

Thanks so much Renjith!

Your going to heaven!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...