How to display logs that have the same _time value from two different fields?

[brieucjulou]

Hello everyone,

I have been looking for an answer all over the forum and documentation, but it still won't work..

I have 2 differents fields: host="server1" OR sourcetype="ws.log"

They produce logs that have nothing in common, but some happens at the same moment on both servers. I want to display only these logs.

example:

all the logs:
log5 from server1 at 16:56:30
log4 from ws.log at 15:35:45
log3 from server1 at 15:35:45
log2 from ws.log at 12:44:23
log1 from ws.log at 11:43:55

display:
log4 from ws.log at 15:35:45
log3 from server1 at 15:35:45

Thank you for your help!

Kind regards

[sduff_splunk · Accepted solution]

Assuming the time is being extracted as _time, you could do

 transaction _time

The difficulty is that the events must happen at the "exact" same time. You may want to use the bin command to round these events to the nearest second.

| bin _time span=1s | transaction _time

Or you could do something like

| bin _time span=1s | stats values(_raw), count by _time | where count > 1

[brieucjulou]

The third command actually works. It gathers the logs into group depending on their time.
I have still some trouble to manipulate the result but I will figure it out!

Thank you!