Splunk Search

How can i calculate the minimum time per source(log file) and then get the logs with a time difference of more than 6 minutes?

aamer86
Path Finder

I have a WAF log source where logs are written to CEF files.

I need a search that calculates the minimum time per log file and then compares the logs within each logs file to this minimum and gets logs that have more than a 6 minutes delay.

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@aamer86,
Assuming you have multiple log files (source) and you want the delay for each of these files.

Try this

index="your index" source="all CEF files"|eventstats earliest(_time) as mintime by source|eval diff=round((_time-mintime)/60,2)
|where diff >=6|stats count by source
Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@aamer86,
Assuming you have multiple log files (source) and you want the delay for each of these files.

Try this

index="your index" source="all CEF files"|eventstats earliest(_time) as mintime by source|eval diff=round((_time-mintime)/60,2)
|where diff >=6|stats count by source
Happy Splunking!
0 Karma

aamer86
Path Finder

thanks that worked

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@aamer86,
What do you mean by minimum time? Is it the first entry from that source for the day ? Or is it the last time the file was updated? And how do you want the delay to be calculated - time difference between event and indexed time ?

Happy Splunking!
0 Karma

aamer86
Path Finder

yes I need to calculate the time range of logs within a single CEF log file so i want to get the first timestamp (minimum time) and then compare the time of each logs within this file with the minimum time for example

first log written to the file at 12pm
next log written at 12:02
.
.
.
last log written to the file 12:30

I need to get a count of logs that has more than 6 minutes difference to the first log entry

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...