Splunk Search

Having Logs at different times?

VijayA
Explorer

Hi, I have log files coming at different times, but i need to compare logs of same time.

1-----Log1 - file received for every 30mins, ex : 12:30,13:00, 13:30,14:00, 14:30,15:00, 15:30

2-----Log2 - file received for every 2hrs ex: 9:00, 11:00 , 13:00 , 15:00

Here, I need to compare the Log1 and Log2 only after receiving Log2, but catch here is if I run report at

for 4hrs , results will be picked from Log1 for which we don't have data in Log2, which is not correct.

I need  results matching same time in both logs.

Is there any way to schedule

 

 

Labels (3)
0 Karma

woodcock
Esteemed Legend

Have a search that runs every 2 hours + 15 minutes (be EXTREMELY mindful that schedules/times are effected by the others/users TZ setting) and looks for a new log2 file.  Using this filename calculate the associated log1 file (I assume the date is somewhere in there).  Do this in a subsearch that generates a search string that contains "source=fooLog1 OR source=fooLog2" and go from there.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What SPL have you tried?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...