×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
insatiableavi
Observer
Member since: ‎11-12-2018
‎12-10-2020
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎11-12-2018
Activity Feed
View All

Re: Evaluate multiple events as one

by in Splunk Search
‎12-03-2020 05:28 PM
‎12-03-2020 05:28 PM
It is something like this: 3/12: Log1: Processing decryptedRecord:{"account":"mainAccount1","EventType":"start"} Log2: Processing decryptedRecord:{"account":"mainAccount1","EventType":"stop"}  Log3: Processing decryptedRecord:{"account":"mainAccount1","EventType":"start"}  Log4: Processing decryptedRecord:{"account":"mainAccount1","EventType":"stop"}  Log5: Processing decryptedRecord:{"account":"mainAccount1","EventType":"stop"}  4/12: Log1: Processing decryptedRecord:{"account":"mainAccount1","EventType":"start"} Log2: Processing decryptedRecord:{"account":"mainAccount1","EventType":"stop"}  Log3: Processing decryptedRecord:{"account":"mainAccount1","EventType":"start"}  my expected output: | Date| account| Event| count| | 3/12|mainAccount1| flap | 2| |4/12| mainAccount1| flap | 1|   where 1 flap is the jump between consequitive start-stop ... View more

Evaluate multiple events as one

by in Splunk Search
‎12-03-2020 03:56 PM
‎12-03-2020 03:56 PM
Hi everyone, I have a data set such as: Log1:  EventId + EventType1 Log 2: EventId + EventType2 Log 3: EventId + EventType1 Log 4: EventId + EventType2 Log 5: EventId + EventType1 The outcome I am trying to get is something like: EventId + (evaluatedEvent3) + counts of evaluatedEvents3 per day Where evaluatedEvent is the occurrence of Event1 and Event2 in a sequence. e.g. If one Event1 and one Event2 are present for ID, it will be counted as one. Similarly, if Event1 is +1 more than Event2, It should not be kept in the Event3 bucket for this ID.   TIA ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎12-10-2020 10:53 PM