Splunk Search
Highlighted

Correlating events over specific days within a time window

Communicator

Hi All,

I'm trying to create correlate events that have taken place on specific times/dates.

As an example:

  • We know a service has gone down around about 25th Aug at 10:05 and again on the 1st Sep 9:45
  • We believe that it happened around +/- 10 minutes of the approximate time (nothing was officially recorded, hence the best guess times)
  • We want to know what computer(s) the service went down on

Our base search is the below but we're wondering if we can build on this (or if there is a better approach)
sourcetype=ServiceSource EventTime="01.09.2013 10:0" [search sourcetype=ServiceSource EventTime="25.08.2013 09:4" | top limit=10 ComputerName | fields + ComputerName] | top limit=10 ComputerName

Thanks in advance.

0 Karma
Highlighted

Re: Correlating events over specific days within a time window

Communicator

*NOTE: We could search by errors but we'd like to narrow down the time window rather than eliminate errors. Given the number of servers involved, reducing the search space is seen at the logical first step.

0 Karma
Highlighted

Re: Correlating events over specific days within a time window

SplunkTrust
SplunkTrust

For running a search on two distinct time ranges you could do something like this (on _internal for executability everywhere):

| stats count | fields - count | eval earliest = strptime("2013-11-11 11:11:11", "%Y-%m-%d %H:%M:%S").";".strptime("2013-11-12 12:12:12", "%Y-%m-%d %H:%M:%S") | makemv delim=";" earliest | mvexpand earliest | eval latest=earliest+600 | map search="search earliest=$earliest$ latest=$latest$ index=_internal | bin _time span=1d | stats count by _time host"

Starting from that, you could do analysis based on most chatty hosts.

View solution in original post

0 Karma
Highlighted

Re: Correlating events over specific days within a time window

Communicator

Thanks, good base search.

0 Karma