Calculate time difference, then calculate average duration per severity level

DTERM — Thu, 05 Jul 2012 15:41:18 GMT

This is a sample snippet from a very large log file:

Each ticket (number) can have many (sometimes in the 100's) updates for each ticket in the logs.

My question is how can I find the average ticket duration for each severity level (levels 1-5).

So how to calculate the time difference between the last and first occurrence of each ticket? Then how to get the average of all severity level times? Can Splunk do that?

Thanks.

Re: Calculate time difference, then calculate average duration per severity level

ayme — Thu, 05 Jul 2012 16:11:24 GMT

Something like this will do the trick where you use strptime() to convert to epoch:

sourcetype=mysourcetype | eval firstOccurrence=strptime(firstOccurrence,"%Y/%m/%d %H:%M:%S") | eval lastOccurrence=strptime(lastOccurrence,"%Y/%m/%d %H:%M:%S") | stats min(firstOccurrence) as firstOccurrence, max(lastOccurrence) as lastOccurrence by ticketNumber   | eval diff=lastOccurrence-firstOccurrence | stats avg(diff) by severity

topic Calculate time difference, then calculate average duration per severity level in Splunk Search

Calculate time difference, then calculate average duration per severity level

Re: Calculate time difference, then calculate average duration per severity level