https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-calculate-the-time-between-the-notable-event-state/m-p/460277#M6617 <P>use <CODE>range()</CODE></P> <P>reference: <A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats">https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats</A></P> Tue, 19 May 2020 23:16:12 GMT to4kawa 2020-05-19T23:16:12Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-calculate-the-time-between-the-notable-event-state/m-p/460274#M6614 <P>I am trying to figure out a way to calculate the time for:</P> <OL> <LI>Time taken for a reviewer to assign the notable ticket from the creation time.</LI> <LI>Time taken for the notable in progress till close.</LI> </OL> <P><CODE>notable</CODE>|search NOT <CODE>suppression</CODE></P> <PRE><CODE>|eval _time=strftime(_time,"%Y/%m/%d %T") |eval review_time=strftime(review_time,"%Y/%m/%d %T") |eval assign_time = case(isnotnull(owner), _time) | eval close_time = case(status=5, review_time) |stats min(_time) as notable_time min(assign_time) as assign_time min(close_time) as close_time by AlertTitle,owner </CODE></PRE> <P>This is giving me notable created time and closed time, but not the state change time.</P> Sun, 07 Jun 2020 16:00:45 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-calculate-the-time-between-the-notable-event-state/m-p/460274#M6614 ajaynyay 2020-06-07T16:00:45Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-calculate-the-time-between-the-notable-event-state/m-p/460275#M6615 <P><CODE>|eval _time=strftime(_time,"%Y/%m/%d %T")</CODE><BR /> This is wrong.<BR /> If you change epoch time to <STRONG>strings</STRONG> ,you can't aggregate times. Keep them stay.</P> <PRE><CODE> | eval assign_time = case(isnotnull(owner), _time) | eval close_time = case(status=5, review_time) | stats min(_time) as notable_time min(assign_time) as assign_time min(close_time) as close_time by AlertTitle,owner | eval state_change_time=your calculation | convert timeformat="%Y/%m/%d %T" ctime(notable_time) ctime(assign_time) ctime(close_time) </CODE></PRE> Tue, 19 May 2020 19:53:31 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-calculate-the-time-between-the-notable-event-state/m-p/460275#M6615 to4kawa 2020-05-19T19:53:31Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-calculate-the-time-between-the-notable-event-state/m-p/460276#M6616 <P>Thank you for that. </P> <P>The issue I see is that every time the notable incident state changes "review_time" is the only field that changes time. So, if I want to calculate the time from creation--&gt;assignment and assignment--&gt;closure its not giving me correct results. </P> <P>For example, if I assign the notable today, the review_time field changes time, but if I close the same notable after sometime, it again updates the review_time field only. So, there is no good way of calculating time taken for old notables which are already closed or still open when the state changes later, unless I am missing something.</P> Wed, 30 Sep 2020 05:30:51 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-calculate-the-time-between-the-notable-event-state/m-p/460276#M6616 ajaynyay 2020-09-30T05:30:51Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-calculate-the-time-between-the-notable-event-state/m-p/460277#M6617 <P>use <CODE>range()</CODE></P> <P>reference: <A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats">https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats</A></P> Tue, 19 May 2020 23:16:12 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-calculate-the-time-between-the-notable-event-state/m-p/460277#M6617 to4kawa 2020-05-19T23:16:12Z