Splunk Search

Join events by closest time

pembleton
Path Finder

Hello, lets say I have events from two sourcetypes:

  1. time, ip, hostname
  2. time, ip, username

Now I want to match username to hostname based on the time and ip field in the following manner:
ip has to be the same, time has to be the closest time (before or after). Any easy out of the box way for doing that?

Tags (1)

martin_mueller
SplunkTrust
SplunkTrust

If you know the two events are less than n seconds apart you could use transaction on the field ip with a maxspan of n seconds.

pembleton
Path Finder

oh, but what I still want is to find the closest one between them, this just gives me a great big list

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Maybe this is what you need then:

... | eventstats values(username) as users values(hostname) as hosts by ip
0 Karma

pembleton
Path Finder

ok, so what i meant is that an event can have numerous partners, meaning many users can come from the same host. and a user could use many hosts.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Event 12:09 is now closer to 12:11 than to 12:05 so 12:09 must be associated with 12:11 and 12:05 loses its "partner".

0 Karma

pembleton
Path Finder

First question - yes
Second - no, why has anything changed?

I'll look into streamstats and come back

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could try using streamstats by ip to add recent usernames and recent hostnames to neighbouring events.

Whether that works depends on your data. For example, if you have this set at 12:10:

12:00 1.2.3.4 host=foohost
12:05 1.2.3.4 user=foouser
12:09 1.2.3.4 host=barhost

You would associate 12:05 with 12:09?
What if at 12:11 you get another event like this:

12:11 1.2.3.4 user=baruser

Would you now associate 12:05 with 12:00?

0 Karma

pembleton
Path Finder

I have that one ready, but I don't know how far apart they are, I want to find the closest one for each event, with no limit.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...