Hi,
I am working on a search that looks for instances of "string1", but only those that are not followed by instances of "string2" in X minutes of time. The search runs once every 24hrs and should produce a total count of the instances found.
I am trying to search with bin command.
| index=x
| search "string1" NOT "string2"
| bin _time span=5min
The problem is that this search looks for 5min in the past, as well as 5min in the future. So if "string2" is present within -5min from "string1", that instance does not get counted, and it should be. It should only be excluded if "string2" is after "string1".
Many Thanks
Try something along these lines - I have used dummy data at 10 minute intervals over a day and looked for string1 which wasn't followed by string2 within an hour, but you should be able to adapt for your usecase.
| gentimes start=-1 increment=10m | rename starttime as _time | fields - endhuman endtime starthuman
| eval field="string".random()%10
| sort 0 -_time
| eval found2=if(field="string2",_time,null())
| streamstats last(found2) as found2
| eval diff=if(field="string1",found2-_time,null())
| where field="string1" AND diff>3600
I keep adapting it. If you wanted to make sure that string1 and string2 are from the same host, at what point would you put that? Thanks
| gentimes start=-1 increment=10m | rename starttime as _time | fields - endhuman endtime starthuman
| eval field="string".random()%10
| eval host="host".mvindex(split("ABC",""),random()%3)
| sort 0 -_time
| eval found2=if(field="string2",_time,null())
| streamstats last(found2) as found2 by host
| eval diff=if(field="string1",found2-_time,null())
| where field="string1" AND diff>3600