https://community.splunk.com/t5/Splunk-Search/How-to-create-Group-events-based-off-a-time-and-an-ID/m-p/626253#M217661 <P>That worked great, thanks!</P> Fri, 06 Jan 2023 20:31:40 GMT add53 2023-01-06T20:31:40Z https://community.splunk.com/t5/Splunk-Search/How-to-create-Group-events-based-off-a-time-and-an-ID/m-p/626229#M217655 <P>I'm fairly new to Splunk and I am having some trouble grouping somethings they way I want</P> <P>I have some data which all have a certain ID and a multitude of other values. I want to be able to group this data if they have the same ID, but only group them in a maximum time interval of 24 hours. This I figured out pretty easily, however, the problem is I would also like to see the actual duration of events.&nbsp;</P> <P>For example, say I have 10 or so events that all have the same ID and they occur within a 5 minute period, I'd want to group them together. I'd also like to be able to group 10 or so events that have the same ID and occur within a 23 hour period.&nbsp;<BR /><BR />I've tried using bins, which groups them properly, but then it gives them all the exact same time, so I don't know how to find the exact duration. I've also tried using time charts and transactions with poor results.</P> <P>Does anyone have any ideas?</P> Fri, 06 Jan 2023 22:30:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-Group-events-based-off-a-time-and-an-ID/m-p/626229#M217655 add53 2023-01-06T22:30:10Z https://community.splunk.com/t5/Splunk-Search/How-to-create-Group-events-based-off-a-time-and-an-ID/m-p/626231#M217657 <P>Try something like this</P><LI-CODE lang="markup">| bin span=24h _time as time_bucket | stats min(_time) as earliest max(_time) as latest by time_bucket id | eval duration = latest - earliest</LI-CODE> Fri, 06 Jan 2023 19:05:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-Group-events-based-off-a-time-and-an-ID/m-p/626231#M217657 ITWhisperer 2023-01-06T19:05:50Z https://community.splunk.com/t5/Splunk-Search/How-to-create-Group-events-based-off-a-time-and-an-ID/m-p/626253#M217661 <P>That worked great, thanks!</P> Fri, 06 Jan 2023 20:31:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-Group-events-based-off-a-time-and-an-ID/m-p/626253#M217661 add53 2023-01-06T20:31:40Z