Splunk Search

Whats the best way to classify events as being "Normal" or "Exception" type of events based on time ranges when i have various different exception windows timings?

magenta
New Member

I have historical events that i'm looking to classify as having occurred during an exception period or not.
The challenge is that there are 12+ categories of events and each type of event has 4 slightly different "Exception Periods" each year. For some of the categories, the exceptional time period can be defined based on # of work days before and after the end of the quarter.

Is there a good way of doing this outside of writing many many IF statements?

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You could write a time-based lookup with three columns: _time, category, period

For each category, you'd put in a row for each transition between normal and exception, along with the timestamp for the transition and the class that started then. The time-based lookup logic should retrieve the youngest row for each event's category that's still before the event's timestamp.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could write a time-based lookup with three columns: _time, category, period

For each category, you'd put in a row for each transition between normal and exception, along with the timestamp for the transition and the class that started then. The time-based lookup logic should retrieve the youngest row for each event's category that's still before the event's timestamp.

0 Karma

magenta
New Member

Thanks i didn't realize lookups could be time based so i think this should work!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...