topic calculate duration between multiple events from same session in Splunk Search

calculate duration between multiple events from same session

sajids — Mon, 30 Jun 2014 09:16:39 GMT

I am dealing with log files which are structured as follows
TimeStamp=1 SessionHandle=1 SessionEvent=A
TimeStamp=2 SessionHandle=1 SessionEvent=B
TimeStamp=3 SessionHandle=1 SessionEvent=C
TimeStamp=4 SessionHandle=1 SessionEvent=D
TimeStamp=5 SessionHandle=1 SessionEvent=E
TimeStamp=6 SessionHandle=1 SessionEvent=F
TimeStamp=7 SessionHandle=1 SessionEvent=G
TimeStamp=8 SessionHandle=1 SessionEvent=H

TimeStamp=10 SessionHandle=2 SessionEvent=A
TimeStamp=11 SessionHandle=2 SessionEvent=B
TimeStamp=12 SessionHandle=2 SessionEvent=C
TimeStamp=13 SessionHandle=2 SessionEvent=D
TimeStamp=14 SessionHandle=2 SessionEvent=E
TimeStamp=15 SessionHandle=2 SessionEvent=F
TimeStamp=16 SessionHandle=2 SessionEvent=G
TimeStamp=17 SessionHandle=2 SessionEvent=H

I want to calculate duration between various events for each session
For ex: timediff between B & A, similarly H-A, H-D, A-F etc for each session separately and display results in single table

Re: calculate duration between multiple events from same session

amitkr0201 — Mon, 30 Jun 2014 10:42:19 GMT

You can use transaction for this.

e.g. for calculating timediff between A & B, you can use something like

...|transaction SessionHandle startswith="SessionEvent=A" endswith="SessionEvent=B"

Re: calculate duration between multiple events from same session

somesoni2 — Mon, 30 Jun 2014 13:29:55 GMT

You may use streamstats to achieve this. Try something like this

Your Base search | streamstats window=1 current=f first(TimeStamp) as prevTimeStamp | eval duration=prevTimeStamp-TimeStamp