topic Start and Endtimes in Splunk Search

Start and Endtimes

ibekacyril — Thu, 26 Mar 2020 18:52:17 GMT

I have this scenario:

log 1: contains -

message: "app started"
_time: 1234

log 2:
message: "ended"
_time: 1235

rex to extract app from log1 and name it app|eval start_time=strftime(_time, "%d-%m-%Y %H:%M:%S") | rex to extract ended from log2 and name it app1|eval end_time=strftime(_time, "%d-%m-%Y %H:%M:%S")| stats values(app) AS app values(app1) as app1 values(start_time) values(endtime) by _time

So when I extracted value of message and time in both logs, I end up in a situation with something like:

app app1 start_time end_time
A               1234          1234
         A      1235          1235

What I am looking for this:

app app1 start_time end_time
A      A       1234          1235

The first occurence of A in app field will be the start details and the first occurence of A in app1 will have the end_time and both should be on the same row. After that, go to the next row and repeat for other occurence of A or what ever is in app field and app1 field in the same way.
I would like your help on this.

Thanks

Re: Start and Endtimes

richgalloway — Fri, 27 Mar 2020 00:49:37 GMT

You can use the coalesce function to combine the app and app1 fields.

rex to extract app from log1 and name it app
|eval start_time=strftime(_time, "%d-%m-%Y %H:%M:%S") 
| rex to extract ended from log2 and name it app1
|eval end_time=strftime(_time, "%d-%m-%Y %H:%M:%S")
| eval app=coalesce(app, app1) 
| stats values(app) AS app  values(start_time) values(endtime) by _time

Re: Start and Endtimes

ibekacyril — Wed, 30 Sep 2020 04:43:52 GMT

So I ended up using using transaction command before using the streamstats. However, I ended up with this table format.

app app1 start_time end_time
A. A. 1234 1234
B. B. 1238. 1253
C. C. 1345. 1345

So now I need to check if both start_time and end_time have the same values and if yes, remove it in the final table. Seems that's the final step for me.

Thanks

Re: Start and Endtimes

ibekacyril — Fri, 27 Mar 2020 02:27:23 GMT

Hello @richgalloway, can you check my comment above? Thank you in advance

Re: Start and Endtimes

richgalloway — Fri, 27 Mar 2020 12:36:41 GMT

... | where start_time != end_time