Splunk Search

Query for finding highest numbers within time

miha
New Member

Hello,

I am trying to find a query structure that would find/identify the largest number of single event within the shortest amount of time.

Example: if I had 1000 IP addresses and I wanted to list all the IPs that were closest to each other form a time perspective. The highest number of IP's within the same hour.
or
Highest number of submissions (based off IP address) within an hour.

Thanks,

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

The fast and easy way is to use timechart, assuming that your base search selects the interesting events, and you only need the hour with the highest count, i.e.

<your search> | timechart span=1h count

The harder way is to find the 60 (or 120) minute period with the highest count (still assuming that your base search will select the interesting events). This search will result in a single line with start and stop times, and of course the max count. Replace the window=60 to any number of your choice.

<your search>| timechart span=1m count AS cc | streamstats sum(cc) AS acc_roll_max window=60 | eval start = strftime (_time - 3600, "%Y-%m-%d %H:%M:%S") | eval stop = strftime(_time, "%Y-%m-%d %H:%M:%S") | sort - acc_roll_max | head 1 | fields - cc, _time  

Hope this helps,

Kristian

miha
New Member

Thanks. Is there a way to do it not defined by the particular hour, but just by any 60 minute period?

Another example:

I have a weeks worth of data. I want to list all the IPs (value) that have the highest number of occurrences within a 60 or 120 minute period.

Thanks,

Thanks

0 Karma

southeringtonp
Motivator

Discrete hours (i.e., 1-2 pm), or on a sliding window? The former is easier than the latter.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...