Splunk Search

How to display logs that have the same _time value from two different fields?

brieucjulou
Engager

Hello everyone,

I have been looking for an answer all over the forum and documentation, but it still won't work..

I have 2 differents fields: host="server1" OR sourcetype="ws.log"

They produce logs that have nothing in common, but some happens at the same moment on both servers. I want to display only these logs.

example:

all the logs:
log5 from server1 at 16:56:30
log4 from ws.log at 15:35:45
log3 from server1 at 15:35:45
log2 from ws.log at 12:44:23
log1 from ws.log at 11:43:55

display:
log4 from ws.log at 15:35:45
log3 from server1 at 15:35:45

Thank you for your help!

Kind regards

Tags (2)
0 Karma
1 Solution

sduff_splunk
Splunk Employee
Splunk Employee

Assuming the time is being extracted as _time, you could do

 transaction _time

The difficulty is that the events must happen at the "exact" same time. You may want to use the bin command to round these events to the nearest second.

| bin _time span=1s | transaction _time

Or you could do something like

| bin _time span=1s | stats values(_raw), count by _time | where count > 1

View solution in original post

sduff_splunk
Splunk Employee
Splunk Employee

Assuming the time is being extracted as _time, you could do

 transaction _time

The difficulty is that the events must happen at the "exact" same time. You may want to use the bin command to round these events to the nearest second.

| bin _time span=1s | transaction _time

Or you could do something like

| bin _time span=1s | stats values(_raw), count by _time | where count > 1

brieucjulou
Engager

The third command actually works. It gathers the logs into group depending on their time.
I have still some trouble to manipulate the result but I will figure it out!

Thank you!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...