Splunk Search

How to tell if event is within X seconds (both forwards/backwards) of another event

duckware
Explorer

Using 'delta' I am able to figure this out, but in one time direction.  Now I need the other time direction.

In the current event, I essentially need to get the answer to: Is there another event within X seconds (both forwards and backwards) of the current event.

Is there a way to do this?

0 Karma
1 Solution

duckware
Explorer

I figured out a way (for my usage case).

In my case, I just needed to mark events with X seconds of another event.  In one direction, this can be done with delta.  But then using sort to reverse direction, and running another delta gets the other direction.

So when events E1 and E2 are with 5 seconds of each other, running a delta one direction marks E2 as being within 5 seconds (of E1). That leaves E1 not marked.  But then sort to reverse direction of the events and delta again then marks E1 as being within 5 seconds (of E2).

View solution in original post

0 Karma

duckware
Explorer

I figured out a way (for my usage case).

In my case, I just needed to mark events with X seconds of another event.  In one direction, this can be done with delta.  But then using sort to reverse direction, and running another delta gets the other direction.

So when events E1 and E2 are with 5 seconds of each other, running a delta one direction marks E2 as being within 5 seconds (of E1). That leaves E1 not marked.  But then sort to reverse direction of the events and delta again then marks E1 as being within 5 seconds (of E2).

0 Karma

bowesmana
SplunkTrust
SplunkTrust

@duckware 

Calculating deltas can be done with delta, as you have discovered or either of these

| autoregress _time as t p=1

| streamstats window=2 current=t range(_time) as r

the first will put _time into the next event and you can do your own calcs and the second does the calc itself.

However, to get the opposite direction, you'll have to reverse the data, so any of these commands can do the calculations, either with | reverse or | sort _time

I don't believe Splunk can do event 'lookahead' to get the value of an event later in the stream to calculate a delta to store in the current event.

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...