Splunk Search

Looking for new events


Good Day Everyone,

I"m trying to construct a search that will search our weblogs over a one hour period and report on IP addresses that didn't appear in the first half hour. I would like to display the sum of new IPs in a timechart. The approach I'm started to take is to search the hour, create 1 minute buckets, group by IP address, and add a column that indicates if it was first half or second half of the hour so the data now looks something like this..
Time IP &nbsp Count Group
08:00 20 First
08:01 27 First
08:00 3 First
08:32 79 Second
08:33 11 Second
08:34 44 Second

So, now I'm trying to Create a TimeChart that includes ALL values from first group, and ONLY IPs in the second group that aren't included in the first group. This is where I'm stumped.

0 Karma

Esteemed Legend

Like this:

... | eval date_minute = strftime(_time, "%M") | eval FirstOrSecond=if((date_minute>=30), "Second", "First") | eventstats dc(FirstOrSecond) AS numHalves BY IP | where FirstOrSecond="First" OR (FirstOrSecond="Second" AND numHalves=1) | timechart ...
0 Karma


index=abc earliest=-60m latest=-31m |table _time IP |eval Group=First | join _time [search index= abc NOT [search index=abc earliest=-60m latest=-31m |dedup IP| table IP] earliest=-30m latest=now |table _time IP|eval Group=Second]| table _time Group

This should give you result from group 2 avoiding IP's from first group.

0 Karma
Get Updates on the Splunk Community!

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...