is there a search condition to get a burst of events in certain short time period?

[leonjxtan]

I wanted to catch burst of events reaching certain threshold in a short period time. I think splunk must have this function but no luck finding it. Could you please point me to the doc?

I imagine the search would look like:

sourcetype=foo condition1=xxx condition2=yyy |where event count within 5 seconds > 100

[leonjxtan · Accepted solution]

got it solved finally. The answer is transaction.
reference: https://docs.splunk.com/Documentation/Splunk/6.5.3/Search/Identifyandgroupeventsintotransactions

sourcetype=foo condition1=xxx condition2=yyy |transaction field1 field2 field3 maxspan=5s maxpause=1s |where eventcount>100

Then you will see the events themselves.

[ctaf]

Hi,

You could use the trendline command which will compute "moving average":

sourcetype=foo condition1=xxx condition2=yyy  | timechart count span=1s | trendline sma5(count) as moving_count_events
| eval burst=if(count> 2 * moving_count_events, 9999999, 0)

Then, you can filter with where command:

... | where burst=9999999

[leonjxtan]

Thanks so I searched with your suggested query, it seems good but it returns a table. How can I modify it to make it return events themselves?

sourcetype=foo condition1=xxx condition2=yyy  | timechart count span=1s | trendline sma5(count) as moving_count_events |where burst=9999999

[ctaf]

You can try replacing timechart by streamstats :

sourcetype=foo condition1=xxx condition2=yyy | streamstats count time_window=1s| trendline sma5(count) as moving_count_events |where burst=9999999