I need your support Splunker ! 🙂
I would like to set up a search that can show result only if there at least 5 special events that occur in 10 minutes and the search need to run in the last 24h.
NB : I want to see nothing if there 60 events separate by more than 10 minutes in 24h.
| : 1 special event
x** : 10 min from the first event special
Here, the search must show in the result only the events in "1*[...]*" and not the others.
Thanks for your help !
There's a third way... I think 🙂
search for special events only | streamstats window=4 current=f count latest(_time) as other_time | where count=4 AND _time >= relative_time(other_time, "-10m")
Here's an example of the logic in action:
| gentimes start=-1 increment=1h | eval _time = starttime | sort - _time | streamstats window=4 current=f count latest(_time) as other_time | where count=4 AND _time >= relative_time(other_time, "-4h")
Events happen every hour, so five occur within four hours - this finds loads. If you change the "-4h" at the end to "-3h" then it finds none because there only are four in three hours.
2 approaches :
search for the events, group them( | transaction myfield) , and define a maximum transaction length of 10 minutes (maxspan=60*10). Then count the events per transaction (they will be in a multivalue field), then finally and add a condition (| where count >5)