topic How to extract time interval between each near two events? in Splunk Search

How to extract time interval between each near two events?

JSIrony — Tue, 08 Mar 2022 04:13:28 GMT

hi, I'm finding how to calculate each time difference from near 2 events

for example,

if my search output is

f1 datetime

A ~~ 09:00

A ~~ 10:00

A ~~ 15:00

B ~~ 06:00

B ~~ 08:30

I want a table like

A 1:00

A 5:00

B 2:30

I prefer to print it without making big temporary output table(for look-up or etc) if I can

can I get some ideas?

yuanliu — Mon, 07 Mar 2022 03:17:49 GMT

Are you looking for delta?

| delta _time as timedelta

JSIrony — Mon, 07 Mar 2022 04:27:43 GMT

thanks 🙂

I considered about delta, but it can't be grouped by another field (like f1 in question i wrote)

now I'm trying using streamstats-range-window=2 with time sorted table like this

| streamstats window=2 range(_time) by f1

are there other better solutions?

yuanliu — Mon, 07 Mar 2022 07:26:34 GMT

If groupby is a requirement (not quite clear in OP), streamstats is the answer.

ITWhisperer — Mon, 07 Mar 2022 09:59:58 GMT

Assuming you have the times (_time) in epoch format

| streamstats range(_time) as timediff window=2 global=f by f1 | where timediff>0 | eval timediff=tostring(timediff,"duration")