Splunk Search

How to group two field values into separate fields?

bofasplunkguy
Explorer

I am working with data that is shared/backed up by two separate hosts. Each userID is linked to two hosts. When there are data issues (server outages, etc), a certain error on the host is triggered. I need to find out when the error is triggered for BOTH hosts at the same time. The error may be triggered every 5 minutes, so I need a table showing each userID, the two hosts that map to that user, and each timestamp that is within 5 seconds (due to latency timestamp may not match exactly).

Therefore, I believe I somehow need to separate the two hosts into separate fields, but am not sure the best way to do this.
The psuedo code would look like:

for each userID{
   if (host1 != host2 && abs(host1.timestamp-host2.timestamp) <= 5 && host1.error==host2.error){
         return (userID, host1,  host2, timestamp) 
   }
}

Is there a way in Splunk that I can generate this table by comparing timestamps of the two hosts that are connected to the userID?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...