Splunk Search

Frequency correlation between different sourcetypes

Explorer

I have two sourcetypes, one containing alerts from users that we have a problem, and another one with server logs. In a first stage, I would like to correlate the number of exceptions and the number of alerts received. I'm struggling with how to implement this, however. I tried starting from (sourcetype="Alerts") OR (sourcetype="ExceptionLog" level="Warning" OR level="Error") | bin _time span=3h. So, I would like to get the number of alerts in a bucket, and associate it with the number of exceptions in the same bucket, but how? I read http://blogs.splunk.com/2012/10/01/simple-correlation-in-splunk, but didn't seem to work for my case.

Tags (1)
0 Karma

Explorer

@jtrucks: The first idea is to explore if there is a correlation between user alerts and exceptions we log. I'd like to do a scatter plot of this over time, which should hopefully make this somewhat clear.

0 Karma

Legend

Try this

 (sourcetype="Alerts") OR (sourcetype="ExceptionLog" level="Warning" OR level="Error") 
| bucket _time span=1d
| stats count(eval(sourcetype="Alerts")) as Alerts count(eval(sourcetype="ExceptionLog")) as Exceptions by host _time

As @jtrucks pointed out, you didn't give any criteria for correlating the two sets of events, so I did it by host and day.

Legend

Aww, raspberry to me! I will fix the answer - thanks.

0 Karma

Explorer

Ah. Changing it to count(eval(sourcetype="Alerts")) makes it work. As is clearly written in the docs. Whoops.

Explorer

Interesting, that is precisely what I tried. What happens is that I get no results from count(sourcetype="AnySource"). I even tried sourcetype!="Alerts"), and I still get a count of zero. Removing the stats command, or removing the sourcetype, works as expected.

0 Karma

Splunk Employee
Splunk Employee

What is your end goal? Are you trying to compare counts, or are you trying to correlate each Alerts event with an ExceptionLog event? Why are you putting it into a bucket specifically rather than simply working with search results? (Not that using a bucket is bad, but I am just looking for your thought process and reasoning so we can help you more.)

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!