Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Bucket two events starting using a timespan starting with the first event

$
0
0
My question is a mix of using the transaction command with the bin command. What I would like to achieve is capturing when 2 consecutive POST requests are made in proxy logs within two seconds of each other. Straight up using | _bin span=2s misses out on events that might happen during odd seconds. Essentially, I want the two second timer to start when the first event occurs, and then looks for the next event (another POST request), within two seconds. Is there a feasible way to achieve what I'm asking for? Or am I not making much sense.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>