Splunk Search

How to display and group events in a timechart that are continuous for 10 minutes?

kartik13
Communicator

Hi ,

I have a timechart with different columns. I want to display those events from a time chart which are continuous at least for 10 minutes.

alt text

I want to group the events which are marked red and yellow on based on the time or event. Help required.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a shot (check the field names)

your current search with timechart | streamstats current=f windows=1 values('Total Error') as prev_error values('Total Auth') as prev_auth
|  where (prev_error='Total Error' AND 'Total Error'!=0) OR (prev_auth='Total Auth' AND 'Total Auth'!=0) 
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Are the column names fixed in your time chart?

0 Karma

kartik13
Communicator

yes they are , these are spikes in the Total Errors and authorization and authentication failures respectively .

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...