[How to] Build a Seach that can detect particular event in 10 minutes

[Micmac]

Hello,

I need your support Splunker ! 🙂

I would like to set up a search that can show result only if there at least 5 special events that occur in 10 minutes and the search need to run in the last 24h.

NB : I want to see nothing if there 60 events separate by more than 10 minutes in 24h.

Sketch :

<====1*[|||||||==]========2[|===|=|]==========3[|========]*==========================> 24h

| : 1 special event

x*[]* : 10 min from the first event special

Here, the search must show in the result only the events in "1*[...]*" and not the others.

Thanks for your help !

[martin_mueller]

There's a third way... I think 🙂

search for special events only | streamstats window=4 current=f count latest(_time) as other_time | where count=4 AND _time >= relative_time(other_time, "-10m")

Here's an example of the logic in action:

| gentimes start=-1 increment=1h | eval _time = starttime | sort - _time | streamstats window=4 current=f count latest(_time) as other_time  | where count=4 AND _time >= relative_time(other_time, "-4h")

Events happen every hour, so five occur within four hours - this finds loads. If you change the "-4h" at the end to "-3h" then it finds none because there only are four in three hours.

[yannK]

2 approaches :

• use a bucket of _time span=10 , but it is possible that your events are split between 2 buckets.
• Use a transaction

search for the events, group them( | transaction myfield) , and define a maximum transaction length of 10 minutes (maxspan=60*10). Then count the events per transaction (they will be in a multivalue field), then finally and add a condition (| where count >5)

see http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction

[Micmac]

Thanks for your quick reply I will check that and let you know.