Splunk Search

comparing events within same field and it should continues

srinivasup
Explorer

We need to find out the Ids along with DispatchTime which are not dispatched in correct sequence.
ID DispatchTime
1 05/22/17 02:13:01
1 05/22/17 02:17:13
1 05/22/17 02:15:33 --- It is dispatched before 2nd event dispatch,
1 05/22/17 02:22:03
2 05/22/17 02:25:56
2 05/22/17 02:26:18
2 05/22/17 02:24:37 ------ it is dispatched before above 2 events.
3 05/22/17 02:31:19
3 05/22/17 02:50:03
3 05/22/17 02:53:29 ----- it is dispatched in wrong sequence
3 05/22/17 02:51:52
4 05/22/17 03:01:34
4 05/22/17 22:01:30
4 05/22/17 22:01:30

Tags (1)
0 Karma

woodcock
Esteemed Legend

Like this:

Your Base Saerch
| eval time = "Dispatch Time"
| rex field=time mode=sed "s/://g"
| streamstats current=f last(time) AS prev_time BY ID
| eval Mispatch = if((time < prev_time), "TRUE", null())
| where isnotnull(Mispatch)
0 Karma

niketn
Legend

As far as your query is giving the above result in the same sequence, you can use streamstats to get the previous value of "Dispatch Time" and then compare that Previous Value should not be greater than current:

<Your Base Search>
| streamstats current=f global=f window=1 last("Dispatch Time") as Last_Dispatch_Time by ID
| eval status=if(isnull(Last_Dispatch_Time) OR Last_Dispatch_Time<='Dispatch Time',"Correct","Incorrect")
| table  ID "Dispatch Time" Last_Dispatch_Time status

PS: isnull(Last_Dispatch_Time) is for the first event since it will not have any data.
Streamstats works based on how data is sorted, so make sure your base query is returning results in the sequence you expect (as mentioned in your question)

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@srinivasup, besides the Dispatch Time do you have event time (i.e. _time) which confirms that Dispatch Times are out of sequence? Also what are the field Names for ID, Dispatch Time?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

srinivasup
Explorer

Hi,

After all calculation i have got this ouput, so now we need to compare Dispatch time sequence for each ID.

If dispatch time sequence is not in order, out of order id and dispatch time should be displayed.

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...