Splunk Search

[How to] Build a Seach that can detect particular event in 10 minutes

Micmac
Path Finder

Hello,

I need your support Splunker ! 🙂

I would like to set up a search that can show result only if there at least 5 special events that occur in 10 minutes and the search need to run in the last 24h.

NB : I want to see nothing if there 60 events separate by more than 10 minutes in 24h.

Sketch :

<====1*[|||||||==]========2[|===|=|]==========3[|========]*==========================> 24h

| : 1 special event

x*[]* : 10 min from the first event special

Here, the search must show in the result only the events in "1*[...]*" and not the others.

Thanks for your help !

Tags (3)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

There's a third way... I think 🙂

search for special events only | streamstats window=4 current=f count latest(_time) as other_time | where count=4 AND _time >= relative_time(other_time, "-10m")

Here's an example of the logic in action:

| gentimes start=-1 increment=1h | eval _time = starttime | sort - _time | streamstats window=4 current=f count latest(_time) as other_time  | where count=4 AND _time >= relative_time(other_time, "-4h")

Events happen every hour, so five occur within four hours - this finds loads. If you change the "-4h" at the end to "-3h" then it finds none because there only are four in three hours.

0 Karma

yannK
Splunk Employee
Splunk Employee

2 approaches :

  • use a bucket of _time span=10 , but it is possible that your events are split between 2 buckets.
  • Use a transaction

search for the events, group them( | transaction myfield) , and define a maximum transaction length of 10 minutes (maxspan=60*10). Then count the events per transaction (they will be in a multivalue field), then finally and add a condition (| where count >5)

see http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction

Micmac
Path Finder

Thanks for your quick reply I will check that and let you know.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...