Splunk Search

How do I search for events which occurred around the same time as another set of events?

Explorer

I've a search, index=foo sourcetype=bar1 service_name="baz" (fault_type="SecurityFault") operation_name=GoRequest,
which returns a set of events.

Now I have another search, index=foo sourcetype=bar2 "Go" to find events from another log which happened around same time as the above events to correlate and find the issue.

I tried using the subsearch as below:

index=foo sourcetype=bar2 "Go" [index=foo sourcetype=bar1 service_name="baz" (fault_type="SecurityFault") operation_name=GoRequest | eval starttime= strptime(field1,"%Y-%m-%dT%H:%M:%S:%3N") | eval endtime= strptime(field2,"%Y-%m-%dT%H:%M:%S:%3N") | table starttime, endtime] earliest=starttime latest=endtime

Above search results in error Unable to parse 1435018459.185000 with format: %m/%d/%Y:%H:%M:%S

Tags (1)
0 Karma
1 Solution

Esteemed Legend

You need the map command like this:

  index=foo sourcetype=bar1 service_name="baz" (fault_type="SecurityFault") operation_name=GoRequest | map search="search earliest=$field1$ latest=$field2$ (index=foo sourcetype=bar2 \"Go\") OR (index=foo sourcetype=bar1 service_name=\"baz\")"

View solution in original post

Esteemed Legend

You need the map command like this:

  index=foo sourcetype=bar1 service_name="baz" (fault_type="SecurityFault") operation_name=GoRequest | map search="search earliest=$field1$ latest=$field2$ (index=foo sourcetype=bar2 \"Go\") OR (index=foo sourcetype=bar1 service_name=\"baz\")"

View solution in original post

Explorer

if the first search doesn't have any results, This is throwing error

Error in 'map': Did not find value for required attribute 'filed1'.

0 Karma

Explorer

index=foo sourcetype=bar1 service_name="baz" (fault_type="SecurityFault") operation_name=GoRequest | map search="search earliest=$field1$ latest=$field2$ (index=foo sourcetype=bar2 \"Go\")" worked for me.

Thanks!

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!