Splunk Search

How can i calculate the minimum time per source(log file) and then get the logs with a time difference of more than 6 minutes?

aamer86
Explorer

I have a WAF log source where logs are written to CEF files.

I need a search that calculates the minimum time per log file and then compares the logs within each logs file to this minimum and gets logs that have more than a 6 minutes delay.

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@aamer86,
Assuming you have multiple log files (source) and you want the delay for each of these files.

Try this

index="your index" source="all CEF files"|eventstats earliest(_time) as mintime by source|eval diff=round((_time-mintime)/60,2)
|where diff >=6|stats count by source

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@aamer86,
Assuming you have multiple log files (source) and you want the delay for each of these files.

Try this

index="your index" source="all CEF files"|eventstats earliest(_time) as mintime by source|eval diff=round((_time-mintime)/60,2)
|where diff >=6|stats count by source

View solution in original post

0 Karma

aamer86
Explorer

thanks that worked

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@aamer86,
What do you mean by minimum time? Is it the first entry from that source for the day ? Or is it the last time the file was updated? And how do you want the delay to be calculated - time difference between event and indexed time ?

0 Karma

aamer86
Explorer

yes I need to calculate the time range of logs within a single CEF log file so i want to get the first timestamp (minimum time) and then compare the time of each logs within this file with the minimum time for example

first log written to the file at 12pm
next log written at 12:02
.
.
.
last log written to the file 12:30

I need to get a count of logs that has more than 6 minutes difference to the first log entry

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!