Duration by messageid and in seconds

Mike6960 — Fri, 02 Aug 2019 08:19:34 GMT

In a earlier question I asked a question about an eval, this was luckily solved by Mus. Now I wonder how i can present the results in one line per ID
This is my search:

<my search>  
| eval Start=if('message.information'=="Start",_time,null()) 
| eval End =if('message.information'=="End",_time,null()) |eval dur= Start-End

What I am searching for is how to get one line per ID , this is unique for all the events I want the duration for.

Re: Duration by messageid and in seconds

renjith_nair — Fri, 02 Aug 2019 09:34:09 GMT

@Mike6960 ,

Try

your search |stats latest(eval(if('message.information'=="Start",_time,null()))) as Start, latest(eval(if('message.information'=="End",_time,null()))) as End by ID |eval dur=Start-End

You may use first as well instead of latest

topic Duration by messageid and in seconds in Splunk Search

Duration by messageid and in seconds

Re: Duration by messageid and in seconds