Splunk Search

Compare the same search over two different time periods

iainp
New Member

I have a number of devices that send logs to Splunk.

I want to know when devices stop logging.

For this example search:

index="mydevices" logdesc="Something that speeds the search" | top limit=40 devicename

How can i find "devicename"s that have logged in the last week that haven't logged in the last 30 minutes?

if that makes sense.

Iain.

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @iainp,

you could try something like this:

index="mydevices" logdesc="Something that speeds the search" earliest=-7d@d latest=now
| eval period=if(now()-_time<1800,"Last 30 minutes","Previous")
| stats 
   dc(period) AS period_count 
   values(period) AS period
   count
   BY devicename
| where period_count=1 period="Previous"
| table devicename

See my approach and adapt it to your Use Case.

Ciao.

Giuseppe

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats latest(_time) as lasttime by devicename
| where now()-lasttime > 1800
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...