Splunk Search

How to search for requests from the same source that happen within given time interval

passogiau
New Member

Greetings,

I need to search for requests from the same username that occur within certain time interval, say, less than 100ms and output various request attributes. How can the query be constructed to extract such requests?

Thanks in advance

Labels (2)
Tags (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Maybe start with something like

base search
| streamstats time_window=100ms values(*) as * by user

where the field 'user' is your username field, but at this point, it very much depends on what you want to do with that data

 

DalJeanis
Legend

That's a very good start, @bowesmana.  Two additions... 

1) As a practice, we always include in the pseudocode a fields command to limit the junk and speed the search. If beginners learn that strategy early on, it will save them centuries of machine time.  When doing values(*) as *, it's especially important.

2) streamstats is finicky with time_window, so if we're doing anything complicated, then we usually include a sort 0 to explicitly validate the event order right before the streamstats.

 

 

base search
| fields _time user ... the exact fields that you want to know about ...
| sort 0 _time user
| streamstats time_window=101ms values(*) as * by user

 

 

I gave it 1 extra ms, since I can never remember whether streamstats is inclusive or exclusive, and with ms it might matter. 

 

bowesmana
SplunkTrust
SplunkTrust

Good point @DalJeanis about the wildcards - you're right, that particular construct is not something you're ever likely to want to do on _raw data given all the additional fields you'd collect on the way, so worth pointing out.

 

 

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...