Splunk Search
Highlighted

How can I search for an event that occurred within five minutes from the last time it happened?

Explorer

Hi,

I need to run a search on an event that will return the occasions where this event happened within 5 minutes of the last time it happened.

Would appreciate any pointers to getting this done.

Thanks

Nimrod

0 Karma
Highlighted

Re: How can I search for an event that occurred within five minutes from the last time it happened?

Esteemed Legend

Like this:

... | reverse | streamstats current=f last(_time) AS prevTime | eval span=_time - prevTime | where span < 300

View solution in original post

Highlighted

Re: How can I search for an event that occurred within five minutes from the last time it happened?

Explorer

Thanks, that's what I was looking for !

0 Karma
Highlighted

Re: How can I search for an event that occurred within five minutes from the last time it happened?

Explorer

A follow up question - I want to show the previous event as well, so I'll see the two events one after the other

How do I manage this?

Thanks

0 Karma
Highlighted

Re: How can I search for an event that occurred within five minutes from the last time it happened?

Esteemed Legend

Either like this:

... | reverse | streamstats current=f last(_time) AS prevTime  last(_raw) AS preEvent | eval span = _time - prevTime | where span < 300

Or like ths:

... | streamstats current=f last(_time) AS nextTime | reverse | streamstats current=f last(_time) AS prevTime | eval forespan = nextTime - _time | eval backspan= _time - prevTime | where backspan < 300 OR forespan < 300
0 Karma