Splunk Search

Grouping events by time within some milliseconds

TBo123
Path Finder

Hello there,

I hope there is someone who can help me. I want to group events that occur within some milliseconds. I tried the transaction command to solve this problem but the minimum of maxpause seems to be 1s. So I don't know how to get rid of this problem. Perhaps there is another solution..

The aim is to get tuples of events that occur within some time interval.

Thanks.

0 Karma
1 Solution

TBo123
Path Finder

I find a way to solve my problem.

I generate IDs for the events which should be grouping by this way:

First I used the delta command to get the difference "diff" between two Events then there is a chance to differ in ms

my base search | delta _time p=1 AS diff | eval ID=case(isnull(diff),1,diff>0.001,1,1=1,0) | accum ID

The result is a new field called ID which show the same ID for Events that occur within some milliseconds.

Thanks to somesoni2 who helped me solve this problem..

View solution in original post

0 Karma

TBo123
Path Finder

I already tried bucket, but it was not the way I am looking for..

0 Karma

TBo123
Path Finder

I find a way to solve my problem.

I generate IDs for the events which should be grouping by this way:

First I used the delta command to get the difference "diff" between two Events then there is a chance to differ in ms

my base search | delta _time p=1 AS diff | eval ID=case(isnull(diff),1,diff>0.001,1,1=1,0) | accum ID

The result is a new field called ID which show the same ID for Events that occur within some milliseconds.

Thanks to somesoni2 who helped me solve this problem..

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Depending on your use case, bucket may be of help:

base search | bucket _time span=25ms | stats something something by _time
0 Karma

somesoni2
Revered Legend

You may try to use "streamstats" command to get the timestamp of previous event and calculate the duration from it. You can then group events with smaller duration. Something like this

your base search | streamstats current=f window=1 first(_time) as prevTime | eval duration=_time | eval shouldGroup=if(duration < yourMinduration,"Y","N") ....

0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...