Splunk Search

How to group two field values into separate fields?

bofasplunkguy
Explorer

I am working with data that is shared/backed up by two separate hosts. Each userID is linked to two hosts. When there are data issues (server outages, etc), a certain error on the host is triggered. I need to find out when the error is triggered for BOTH hosts at the same time. The error may be triggered every 5 minutes, so I need a table showing each userID, the two hosts that map to that user, and each timestamp that is within 5 seconds (due to latency timestamp may not match exactly).

Therefore, I believe I somehow need to separate the two hosts into separate fields, but am not sure the best way to do this.
The psuedo code would look like:

for each userID{
   if (host1 != host2 && abs(host1.timestamp-host2.timestamp) <= 5 && host1.error==host2.error){
         return (userID, host1,  host2, timestamp) 
   }
}

Is there a way in Splunk that I can generate this table by comparing timestamps of the two hosts that are connected to the userID?

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...