Splunk Search

splunk query request to identify a continous sequence of number

venky1544
Builder

i have a below data generated by a timechart  i'm trying to write a query where if there are continous sequence of number 1 in a span of 15 mins  it should alert me 

index=abc  "Heartbeat*"  |timechart span=2m count 

2021-10-04 10:20:001
2021-10-04 10:22:001
2021-10-04 10:24:001
2021-10-04 10:26:001
2021-10-04 10:28:001

 

when the

 

Labels (1)
0 Karma

somesoni2
Revered Legend

Give this a try

index=abc  "Heartbeat*"  |timechart span=2m count 
| streamstats current=f window=1 values(count) as prev_count
| stats sum(eval(abs(count-prev_count))) as diff
| where diff=0

Basically comparing every row's count value with previous row's count value and checking if difference is 0 (means they're all same).

0 Karma

PickleRick
SplunkTrust
SplunkTrust

There is a command especially for using previous values - autoregress

So checking if the value is the same as previous one is easier:

<your-search> | autoregress field
| where field=field_p1

But I think I'd use a transaction here. With resetonchange=t

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...