Splunk Search

How to find list of all events within time window of other events?

brajaram
Communicator

I have a query that looks like this:

    index=A ( ErrorCode=2 OR ErrorCode=3) 
    [ search index=B  Criteria=1
    | table userName]

This query will look for all users that have criteria=1 in their event, and then look to see if they have criteria 2 (in a separate index/sourcetype).

However, what I am really looking for is the events that occur 1 minute after Criteria 1 is triggered. I want to see how many users are experiencing errors right after criteria 1 is triggered. With this search, if a user experienced the criteria yesterday, but the errors today, it would show up.

I assume I need to carry the _time field over somehow and marry it to the username? Not sure how to go about doing this.

Tags (2)
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Try something like this ...

 index=A ( ErrorCode=2 OR ErrorCode=3) 
 [ search index=B  Criteria=1
 | table _time userName
 | eval earliest=_time 
 | eval latest=_time+60 
 | fields - _time
 | format "(" "(" "" ")" "OR" ")" 
 | rex mode=sed field=search "s/\"//g" 
 ]

The return values from the search code in square brackets end up being formatted something like this

( ( earliest=1536192351.692 latest=1536192411.692  userName=value1  ) OR 
  ( earliest=1536192351.692 latest=1536192411.692  userName=value2  ) OR ... )

Where those 153619235X.XXX values are epoch times.

The rex line kills the quotes around the values, which must be done for the earliest and latest values to be interpreted correctly.

If userNames may contain internal quotes or special characters, then the rex should be replaced by a strftime command back when the values of earliest and latest are being calculated, to translate them into the character values accepted by Splunk.

Let us know if you need that.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...