Splunk Search

Need a query for the same event repeated in a defined time

esaionz
New Member

Hi,
I need a query to show me all occurrances when the same message is logged within 200ms.
Log example:

Message="Landed on page"
xxxxxx
yyyyyyy
Message="Landed on page"
zzzzzzz
uuuuu
jjjjjjjjjjj
Message="Landed on page"

I need to show all Message="Landed on page" which happened only with 200ms time from each other.
Thanks!

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

try this. (replace with the actual index and sourcetype)

index=myindex sourcetype=something Message="Landed on page"
| streamstats current=f window=1 last(_time) as next_time by Message
| reverse
| streamstats current=f window=1 last(_time) as last_time by Message
| where (next_time < _time + 0.2) OR (laxt_time > _time - 0.2) 

This will give you every Message that is within 200 ms (0.2 second) of another of the same Message.

0 Karma

to4kawa
Ultra Champion

use streamstats range() and select with where

0 Karma

esaionz
New Member

I'm new to Splunk, how should I use it?. index=* message where message is repeated within 200ms. Thanks.

0 Karma

to4kawa
Ultra Champion

see reference and try examples. and then, make your query.
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Streamstats
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Where

your log is unclear. so , you should make query yourself.

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...