topic Re: Duration between events - Max gap (not the start and end points) in Splunk Search

Duration between events - Max gap (not the start and end points)

stephenreece — Wed, 30 Sep 2020 03:59:57 GMT

hi all .

I am trying to create a map where I can look at users max duration between logins who register with us between 2 fixed dates i.e. jan17-feb17.

So i have the following which is interesting but doesnt give the max length.

| dedup eventId
| stats count(_time) as appear_count, values(_time) as appear_dates max(_time) as last min(_time) as latest by customerNumber
| eval first_appear=strftime(first,"%d/%m/%Y")
| eval last_appear=strftime(last,"%d/%m/%Y")
| eval appear_dates=strftime(appear_dates,"%d/%m/%Y")
| eval duration=(last-latest)
| eval duration=round((last-first)/86400)
| where first<01/02/2019

For example i have a user that has used the service 400 times with a max break of about a week. So i needed the search to pick up the user where first appear = jan-feb2017 and then i need to know that this user has had at max a weeks break between accessing.

Does this make sense.

Its almost as if i need towrite the search to collect all users where first<28/02/2017.

- and then i need to eval each event in order and subtract the later from the earlier,.. so for someone who accessed the service 5 times it would be

USER ONE
first=22/02/2017
event 1 22/02/2017
event 2 25/02/2017 (diff between event 2-1 = 3days)
event 3 01/03/2017 (diff between event 3-2 = 4days)
event 4 09/03/2017 (diff between event 2-1 = 8days)
LAST event 5 10/03/2017 (diff between event 2-1 = 1day)

Therefore max duration between events = 8days

Re: Duration between events - Max gap (not the start and end points)

stephenreece — Tue, 04 Feb 2020 10:31:52 GMT

no... can't be this straight forward

| streamstats current=t window=2 range(_time) AS duration BY customerNumber
| stats min(duration) AS Min max(duration) AS Max avg(duration) AS Avg BY customerNumber

Re: Duration between events - Max gap (not the start and end points)

Richfez — Tue, 04 Feb 2020 15:54:08 GMT

That is about the answer I was going to suggest and should give you correct results.

If your testing shows it is (which is should be), why not write that up as your own answer, then mark it as accepted? It's perfectly acceptable to [at least occasionally] answer your own questions!

-Rich

Re: Duration between events - Max gap (not the start and end points)

DalJeanis — Tue, 04 Feb 2020 19:58:41 GMT

Yep. Write it up and accept it.