Splunk Search

How can i calculate the minimum time per source(log file) and then get the logs with a time difference of more than 6 minutes?

aamer86
Path Finder

I have a WAF log source where logs are written to CEF files.

I need a search that calculates the minimum time per log file and then compares the logs within each logs file to this minimum and gets logs that have more than a 6 minutes delay.

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@aamer86,
Assuming you have multiple log files (source) and you want the delay for each of these files.

Try this

index="your index" source="all CEF files"|eventstats earliest(_time) as mintime by source|eval diff=round((_time-mintime)/60,2)
|where diff >=6|stats count by source
Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@aamer86,
Assuming you have multiple log files (source) and you want the delay for each of these files.

Try this

index="your index" source="all CEF files"|eventstats earliest(_time) as mintime by source|eval diff=round((_time-mintime)/60,2)
|where diff >=6|stats count by source
Happy Splunking!
0 Karma

aamer86
Path Finder

thanks that worked

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@aamer86,
What do you mean by minimum time? Is it the first entry from that source for the day ? Or is it the last time the file was updated? And how do you want the delay to be calculated - time difference between event and indexed time ?

Happy Splunking!
0 Karma

aamer86
Path Finder

yes I need to calculate the time range of logs within a single CEF log file so i want to get the first timestamp (minimum time) and then compare the time of each logs within this file with the minimum time for example

first log written to the file at 12pm
next log written at 12:02
.
.
.
last log written to the file 12:30

I need to get a count of logs that has more than 6 minutes difference to the first log entry

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...