Splunk Search

Return only those events who exist in consecutive time bins

jpawloski
Path Finder

So I'm working on a search that returns standard network stuff and using a bin to bucket the data by a day. Something like this:

base search earliest=-7d | bin _time span=1d as window | stats count(dest) as destination values(this) as this values(that) as that by ip window | where destination > 2

So this works but what I'm really interested in seeing are those ip values that exist in more than one window bin. I can't think of a way to break it down from what has effectively been the end of the search up to this point. Any ideas?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi
If you don't have fields, you could use something like this:

 base search earliest=-7d
| timechart span=1d count
| delta count AS delta
| where delta=0 AND count=1

In this way, you have all the day where there's

If instead you have to check the difference also using fields (as ip or windows) you have to use the transaction command that's not so performant.

base search earliest=-7d
| transaction maxspan=2m ip window
| where eventcount>1

This search runs only if you have at max one event in each hour

There's also another solution that seems to run on my test data but you should test:

base search earliest=-7d
| eval col=ip." ".window
| timechart span=1m dc(col) AS count
| delta count AS delta
| where delta=0 AND count>0

Bye.
Giuseppe

0 Karma

ololdach
Builder

Hi jpawloski,
right after the bin command, you have a bunch of IP values each with a window value attached to it. You want to find those IP that are in two or more consecutive windows. My first approach to this would be to use transaction ip maxpause=1d . That would group all those events, that are consecutive and discard the rest.
Hope it helps
Oliver

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...