topic Re: Calculate duration in Splunk Search

How can I calculate duration?

jacknguyen — Mon, 06 Mar 2023 14:51:50 GMT

Hi I want to calculate duration. For example, I have 2 different event in a source
First event:

04/03/2023 PLUGIN_CLIENT_CONNECT (this is not a field in event)
17:10:15.000

Second event:

04/03/2023 PLUGIN_CLIENT_DISCONNECT (this is not a field in event)
17:51:15.000

I want to cal duration between them.

Expected result with table:

Start Time End Time Hours Ago

04/03/2023 04/03/2023 41 minutes (and hours if have)
17:10:15.000 17:51:15.000

Anyone can help me??? Thank you for pay time

Re: Calculate duration

ITWhisperer — Sat, 04 Mar 2023 15:50:13 GMT

How to you correlate the two events? For example, is there a field (or at least data) in both events which uniquely ties the two events together?

| eval starttime=if(<PLUGIN_CLIENT_CONNECT>,_time,null()) | eval endtime=if(<PLUGIN_CLIENT_DISCONNECT>,_time,null()) | stats value(starttime) as starttime values(endtime) as endtime by <unique correlation value field> | eval duration=endtime-starttime

Re: Calculate duration

jacknguyen — Sun, 05 Mar 2023 05:57:16 GMT

in both event I have field is profile. Howerver both of that were extracted in different time. I tried to use join fuction with "profile" but the start time and end time column is empty when I use table. And Hours Ago column was shown Null Hours

Re: Calculate duration

ITWhisperer — Sun, 05 Mar 2023 07:50:29 GMT

It is always difficult to provide a complete solution without exact details of the problem.

Please can you share the events (anonymised of course) in a code block </> to preserve any formatting that may be present?

Also, please can you share the unsuccessful SPL you are using in case there is an error there?

Re: Calculate duration

jacknguyen — Mon, 06 Mar 2023 02:54:27 GMT

there are 2 logs about connect and disconnect. Both of them have same filed is profile (jack_nguyen)

Re: Calculate duration

ITWhisperer — Mon, 06 Mar 2023 09:58:04 GMT

Assuming the profile uniquely identifies the session you want to measure, try this

| rex "(?<event>PLUGIN_CLIENT_CONNECT|PLUGIN_CLIENT_DISCONNECT)" | eval starttime=if(event=="PLUGIN_CLIENT_CONNECT",_time,null()) | eval endtime=if(event=="PLUGIN_CLIENT_DISCONNECT",_time,null()) | stats value(starttime) as starttime values(endtime) as endtime by profile | eval duration=endtime-starttime

If it doesn't, do you want another field value that does uniquely tie these events together?