Identify when has appear more than 10 errors in one hour

[nsanchezfernand]

Hi, splunkers.

I need to generate an alert when the count of errors are greater than 10 in one hour. This is easy, but now, I need to do an evolution time chart with the alerts that have occurred. With the data of last one month, I had thought make a timechart with span=1h, but this really does not give the wanted result (because, for example, if we have 5 errors between 12:00 and 13:00, and 7 errors between 13:00 and 14:00 it does not showing error, but it can be error if the 12 errors would be within period of 60 minutes).

We have same trouble with transaction. If I make a transaction establishing a maxspan of 1h, Splunk would detects the first error event and would search error events for next hour, making that if there are 5 errors in the first time period, and 7 in the next period, it does not recognizing it like there was more than 10 errors in a period of 60 mins. We have tried to use maxevents in transaction instead of maxspan and making a eval the duration of the transaction, but in this case Splunk would make bundles of 10 events, because of this neither is valid to our needed.

Could you help me?

Thanks a lot!!!

[DalJeanis]

Start with the solution here, to collect and mark all the events you want. Obviously, you will change the conditions to be 60m and specify the events you want to portray...

https://answers.splunk.com/answers/597583/count-something-with-a-specifc-rule-and-time.html#answer-5...

Do the optional thing at the end to mark all the individual events, then drop all the ones that are not marked.

This gives you events that you can just drop straight into timechart and let it do its thing.