Splunk Search

Is there a way to search the count of how many times the same log message got logged seconds apart from each other?

New Member

Is there a way to see if the same log message got logged seconds apart from each other and get a count on how many times such back-to-back activity occurred in a given time period?

Any help appreciated.

Thanks in advance.

Tags (3)
0 Karma

Explorer

Do you know what the message is, or is it dynamic?

0 Karma

Legend

You may be able to achieve this using the transaction command with the maxpause option. Here's some documentation on that. Your search would look something like this

your base search | transaction message maxpause=60m | stats count by message

http://docs.splunk.com/Documentation/Splunk/6.4.0/SearchReference/Transaction

0 Karma