How to do a time based search for router logs?

[salmanrc]

Hello,
I am new to Splunk, so trying to get familiarize with it. I want to do a time based search for router logs, for example.

I have a Syslog A and a syslog B. Trying to do a search such that the search should show results if Syslog B occurred within 60 mins of Syslog A.

Any help is appreciated. thanks

[cmerriman]

what version of Splunk are you on? 6.5 has a new option for streamstats called time_window that allows you to look at a window of time (in your case, 1 hour) and you can group events together that way.

maybe something like (depending on your data): |sort 0 _time|streamstats values(syslogA) as syslogA by syslogB time_window=60m

https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Streamstats

[salmanrc]

we have 6.5.2, so will give it a try, thanks for the reply.