Splunk Search

How to display logs that have the same _time value from two different fields?

brieucjulou
Engager

Hello everyone,

I have been looking for an answer all over the forum and documentation, but it still won't work..

I have 2 differents fields: host="server1" OR sourcetype="ws.log"

They produce logs that have nothing in common, but some happens at the same moment on both servers. I want to display only these logs.

example:

all the logs:
log5 from server1 at 16:56:30
log4 from ws.log at 15:35:45
log3 from server1 at 15:35:45
log2 from ws.log at 12:44:23
log1 from ws.log at 11:43:55

display:
log4 from ws.log at 15:35:45
log3 from server1 at 15:35:45

Thank you for your help!

Kind regards

Tags (2)
0 Karma
1 Solution

sduff_splunk
Splunk Employee
Splunk Employee

Assuming the time is being extracted as _time, you could do

 transaction _time

The difficulty is that the events must happen at the "exact" same time. You may want to use the bin command to round these events to the nearest second.

| bin _time span=1s | transaction _time

Or you could do something like

| bin _time span=1s | stats values(_raw), count by _time | where count > 1

View solution in original post

sduff_splunk
Splunk Employee
Splunk Employee

Assuming the time is being extracted as _time, you could do

 transaction _time

The difficulty is that the events must happen at the "exact" same time. You may want to use the bin command to round these events to the nearest second.

| bin _time span=1s | transaction _time

Or you could do something like

| bin _time span=1s | stats values(_raw), count by _time | where count > 1

brieucjulou
Engager

The third command actually works. It gathers the logs into group depending on their time.
I have still some trouble to manipulate the result but I will figure it out!

Thank you!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...