topic Re: How to search the time difference between start and end events for each unique event ID? in Getting Data In

How to search the time difference between start and end events for each unique event ID?

kflavin — Wed, 17 Jun 2015 22:45:48 GMT

I have a log file going to Splunk which indicates the start and end of an event for VM creation. For example, in the logs I see something like this:

6/15/2015 11:00:00 <unique ID 1> Start event
... other events...
6/15/2015 11:02:00 <unique ID 1> End event
... other events...
6/15/2015 11:04:00 <unique ID 2> Start event
... other events...
6/15/2015 11:05:00 <unique ID 2> End event

I want to be able to get the time difference between the start and end event for all unique events as given by "unique id X".

Another way of saying it is, for all unique ID's, do eval(endtimestamp - starttimestamp), and print out the time difference in table form. I'm struggling to figure out how to do this through Splunk though. Can anyone point me in the right direction?

Re: How to search the time difference between start and end events for each unique event ID?

woodcock — Wed, 17 Jun 2015 22:51:06 GMT

Like this (assuming you are already extracting Unique ID as UniqueID😞

... | stats earliest(_time) AS startTime latest(_time) AS endTime by UniqueID | eval DurationSeconds=(endTime - startTime)

Re: How to search the time difference between start and end events for each unique event ID?

kflavin — Wed, 17 Jun 2015 23:33:20 GMT

Thanks. I'm still trying to get the uniqueid extracted as a field, then I'll give it a try.

Re: How to search the time difference between start and end events for each unique event ID?

woodcock — Wed, 17 Jun 2015 23:58:41 GMT

Try something like this:

... | rex "^\d+/\d+/\d+\s+\d+:\d+:\d+\s+(?<UniqueID>\S+)" | stats earliest(_time) AS startTime latest(_time) AS endTime by UniqueID | eval DurationSeconds=(endTime - startTime)

Re: How to search the time difference between start and end events for each unique event ID?

kflavin — Thu, 18 Jun 2015 03:28:47 GMT

Working! Thanks for your help.