Splunk Search

How can I search for an event that occurred within five minutes from the last time it happened?

NimrodSky
Explorer

Hi,

I need to run a search on an event that will return the occasions where this event happened within 5 minutes of the last time it happened.

Would appreciate any pointers to getting this done.

Thanks

Nimrod

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

... | reverse | streamstats current=f last(_time) AS prevTime | eval span=_time - prevTime | where span < 300

View solution in original post

woodcock
Esteemed Legend

Like this:

... | reverse | streamstats current=f last(_time) AS prevTime | eval span=_time - prevTime | where span < 300

NimrodSky
Explorer

A follow up question - I want to show the previous event as well, so I'll see the two events one after the other

How do I manage this?

Thanks

0 Karma

woodcock
Esteemed Legend

Either like this:

... | reverse | streamstats current=f last(_time) AS prevTime  last(_raw) AS preEvent | eval span = _time - prevTime | where span < 300

Or like ths:

... | streamstats current=f last(_time) AS nextTime | reverse | streamstats current=f last(_time) AS prevTime | eval forespan = nextTime - _time | eval backspan= _time - prevTime | where backspan < 300 OR forespan < 300
0 Karma

NimrodSky
Explorer

Thanks, that's what I was looking for !

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...