Splunk Search

Correlating events and specifying a timerange for how close the events need to be

Champion

I'd like to be able to historically search my events and be able to correlate events from 2 different sources. One source is a dhcp log which stores ips and hostnames that are time-specific.

Is there a command that I can use to specify how close the events must be to match? I guess I'm looking for something similar to maxspan in transaction. But I don't want to use transaction due to the expense.

0 Karma

Champion

Its not apparent to me what the value of "log2" should be in your example.

0 Karma

Splunk Employee
Splunk Employee

Here is a link to an Answer from Stephen Sorkin.

http://splunk-base.splunk.com/answers/103/transaction-vs-stats-commands

I believe you can use the "stats range" instead of transaction but it depends on the data. Here is an example:

... | transaction trade_id | chart count by duration span=log2

is the same as:

... | stats range(_time) as duration by trade_id | chart count by duration span=log2
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!