Splunk Search

How to merge events that are +/- 2 minutes apart into one single event using Transaction or Stats.

cedmarjls32
New Member

I have the following table and even if some of the events don’t indicate the same minute, they are part of the same incident (in my example, the three lines at the top and the two lines at the bottom).

I’d like to know how to merge the lines with different timestamps, based on the following rule: events with no more than 2 minutes difference between them = one single event.

customer    description status  timedown
customer    IP Switch   DOWN    03/06/2015 15:53
customer    IP Switch   DOWN    03/06/2015 15:53
customer    IP Switch   DOWN    03/06/2015 15:51
customer    IP Switch   DOWN    03/06/2015 15:28
customer    IP Switch   DOWN    03/06/2015 15:28
customer    IP Switch   DOWN    03/06/2015 15:28
customer    IP Switch   DOWN    03/06/2015 14:38
customer    IP Switch   DOWN    03/06/2015 14:38
customer    IP Switch   DOWN    03/06/2015 14:38
customer    IP Switch        DOWN   03/06/2015 13:52
customer    IP Switch   DOWN    03/06/2015 13:51

I’ve been told that Transactionwas a CPU nightmare so I’d like if possible to avoid using it. I believe this can also be achieved with Stats?

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

I do try to avoid transaction whenever possible but your use case is a good fit so try this:

... | transaction maxpause=2m customer description

View solution in original post

0 Karma

woodcock
Esteemed Legend

I do try to avoid transaction whenever possible but your use case is a good fit so try this:

... | transaction maxpause=2m customer description
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...