Time search for log

[keshab]

Hi,

What will be the search condition if I wanna display only one log line if they occur within 5 min??

For e.g.

10:10:30 tomcat trying to restart
10:9:10 tomcat trying to restart

I want splunk to count those two events as one if they occur within 5 min time duration.

[Ayn]

You could use transaction with a maxpause of 5 minutes. That way Splunk will create a new transaction when no additional events are found within 5 minutes after an event. Let's say the text you're matching on is available in the field "status_message".

... | transaction maxpause=5m status_message

Using this you'll get a bunch of transactions - in the cases where another event has occurred within 5 minutes after the a previous event, all these events will be put into the same transaction.