Splunk Search

How to search for overlapping events that occurred on the same host?

mitchabaza
Explorer

Given the Splunk result set in the attached screenshot, I'd like to formulate a search that finds all overlapping events that occurred on the same host. Many thanks!

0 Karma

songhyunho
New Member

What about this?

| stats values(MessageKey) by host
Or
| chart count over host by MessageKey usenull=f

0 Karma

jluo_splunk
Splunk Employee
Splunk Employee

You could use the transaction command, for example:

.... | transaction host

0 Karma

mitchabaza
Explorer

This returns no results.

0 Karma