topic Re: Collecting _time from a different event in Splunk Search

Collecting _time from a different event

strehb18 — Mon, 21 Dec 2020 21:07:25 GMT

Hello,

I am hoping this is easy and I am blanking. I have a data source the logs what work order is in station one. I am looking to get an offline_time based on when a work order reaches a certain station.

Ex
_time WO count

11:45 1231 1

11:40 1232 2

11:35 1233 3
11:30 1234 4 ..... etc

So the _time is when the work starts and when count reaches a certain number, the work order would be done on the line(count would equal 35 in my case) . I would like to collect the _time of what is in count=1 when the count reaches 35.

Thanks.

Re: Collecting _time from a different event

renjith_nair — Tue, 22 Dec 2020 02:17:21 GMT

you may use stats/eventstats with eval

Please try this run anywhere example. It injects the time of first event in every event. Let's know what's your final expected result

Re: Collecting _time from a different event

strehb18 — Tue, 22 Dec 2020 20:26:29 GMT

This works for when looking at one specific record. What I am looking for is to record the _time when a work order reaches at specific count number. I would like to record the _time when a WO hits count=6, count= 12, count = 18.... etc to record when the work order hits certain spots on the count. The problem is my dataset records them just when they begin the work order.

So ideally, I'd have the time at specific count numbers, but the only way I can tell when that time would be is by when the most recent one starts.

Re: Collecting _time from a different event

renjith_nair — Wed, 23 Dec 2020 03:20:23 GMT

Ok, how do you know that the WO hits that count? Or is that defined? Using the previous dummy search, could you please point out the values manually and the steps to decide the count number?

Thanks!

Re: Collecting _time from a different event

strehb18 — Wed, 23 Dec 2020 15:21:20 GMT

So I guess that is what my problem is. After the next event is added, the count changes. I could make it static but then wouldn't be able to tell when events are at certain spots. So I was wondering how to log a time when each event reaches the count of a certain number.

So something like, looking at two different scenarios where we collect the _time when a count reaches 3.

_time WO Count time_to_log
9:15 1234 1

9:00 1233 2

8:45 1232 3 9:15

8:30 1231 4 9:00

Next Event comes

_time WO Count time_to_log

9:30 1235 1

9:15 1234 2

9:00 1233 3 9:30

8:45 1232 4 9:15

8:30 1231 5 9:00

Re: Collecting _time from a different event

renjith_nair — Mon, 28 Dec 2020 03:46:14 GMT

Ok, if you know the counter, 3 in our case, you may try this

You can play around by changing count=5 to another values and also the COUNTER=3 to other values