topic Re: How can I calculate the timediff based on non-sequential sequence IDs? in Splunk Search

How can I calculate the timediff based on non-sequential sequence IDs?

khavildar — Wed, 27 Jun 2018 22:52:14 GMT

I have a requirement wherein I have to find timedifference of 2 events. Below is an example on the event type:

Host    Time          SeqID      Transaction
a          1:00:00      5               Start
b          1:30:00      7               Start
a          1:45:00      9               Complete
b          2:00:00      14             Complete
a          4:00:00      19             Start
c           4:30:00      23             Start
a          4:45:00       25            Complete

I need to calculate the timedifferences between 'Start' and 'Complete' for every Host using their SeqID.
To translate roughly, its like
concat(hostname,Time@Complete,SeqId@Complete) - concat(hostname,Time@Start,SeqID@Start)
But in the above calculation, i need to ensure the SeqID@Complete is the most numerically nearest one to the SeqID@Start.

Any thoughts / suggestions?

Re: How can I calculate the timediff based on non-sequential sequence IDs?

renjith_nair — Thu, 28 Jun 2018 01:29:33 GMT

Hi @khavildar,

Try this

index="your index"  "your other search terms"|table _time,host,SeqID ,Transaction|sort host,SeqID |streamstats current=f last(_time) as prev by host|eval time_diff=_time-prev|where Transaction="Complete"|table host,SeqID ,time_diff

Re: How can I calculate the timediff based on non-sequential sequence IDs?

khavildar — Thu, 28 Jun 2018 20:12:46 GMT

Works like a charm! Perfect.
Thanks so much!