topic Re: Make a slippery transaction within 20 events, how do I calculate the duration between the 1st and 20th event, 2nd and 21st, etc? in Splunk Search

Make a slippery transaction within 20 events, how do I calculate the duration between the 1st and 20th event, 2nd and 21st, etc?

collier31200 — Wed, 22 Jul 2015 15:13:16 GMT

Hello all,

I'm trying to make a slippery transaction within 20 events.
For example, my search return 40 events and I need to calculate the duration between:
the first event and the twentieth,
the second and the twenty first,
the third and the twenty second
etc...

With this:

transaction Routed maxevents=20 mvlist=t

Splunk only calculates 2 durations: between the first event and the twentieth, and the twenty first and the fortieth.

Please HELPPP 🙂

Re: Make a slippery transaction within 20 events, how do I calculate the duration between the 1st and 20th event, 2nd and 21st, etc?

martin_mueller — Wed, 22 Jul 2015 16:15:51 GMT

If you're only looking for the duration you can use this:

index=foo sourcetype=bar Routed=* | streamstats window=20 global=f range(_time) as duration by Routed

Note, the first nineteen events may compute the duration between 1 and 1, 1 and 2, ..., 1 and 19.

Re: Make a slippery transaction within 20 events, how do I calculate the duration between the 1st and 20th event, 2nd and 21st, etc?

collier31200 — Mon, 27 Jul 2015 09:56:35 GMT

Thanks a lot, perfectly doing what I want 🙂
I used:
where row >20
to remove the twenty first events