Splunk Search

How to do a time based search for router logs?

salmanrc
New Member

Hello,
I am new to Splunk, so trying to get familiarize with it. I want to do a time based search for router logs, for example.

I have a Syslog A and a syslog B. Trying to do a search such that the search should show results if Syslog B occurred within 60 mins of Syslog A.

Any help is appreciated. thanks

0 Karma

cmerriman
Super Champion

what version of Splunk are you on? 6.5 has a new option for streamstats called time_window that allows you to look at a window of time (in your case, 1 hour) and you can group events together that way.

maybe something like (depending on your data): |sort 0 _time|streamstats values(syslogA) as syslogA by syslogB time_window=60m

https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Streamstats

0 Karma

salmanrc
New Member

we have 6.5.2, so will give it a try, thanks for the reply.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...