Splunk Search

How to create Group events based off a time and an ID?

add53
Engager

I'm fairly new to Splunk and I am having some trouble grouping somethings they way I want

I have some data which all have a certain ID and a multitude of other values. I want to be able to group this data if they have the same ID, but only group them in a maximum time interval of 24 hours. This I figured out pretty easily, however, the problem is I would also like to see the actual duration of events. 

For example, say I have 10 or so events that all have the same ID and they occur within a 5 minute period, I'd want to group them together. I'd also like to be able to group 10 or so events that have the same ID and occur within a 23 hour period. 

I've tried using bins, which groups them properly, but then it gives them all the exact same time, so I don't know how to find the exact duration. I've also tried using time charts and transactions with poor results.

Does anyone have any ideas?

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| bin span=24h _time as time_bucket
| stats min(_time) as earliest max(_time) as latest by time_bucket id
| eval duration = latest - earliest

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| bin span=24h _time as time_bucket
| stats min(_time) as earliest max(_time) as latest by time_bucket id
| eval duration = latest - earliest

add53
Engager

That worked great, thanks!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...