topic Re: create lagtime panel with average time between two string value datetime fields in Splunk Search

create lagtime panel with average time between two string value datetime fields

jdepp — Fri, 02 May 2014 13:10:25 GMT

I have two datetime fields that I would like to use to calculate average lagtime as each message coming contains these fields. I would like to display some sort of panel showing this in seconds.

pubDate:"2014-04-30 11:27:49"   scrapeDate:"2014-04-30 11:27:53"

any help appreciated.

Re: create lagtime panel with average time between two string value datetime fields

richgalloway — Fri, 02 May 2014 13:52:31 GMT

... | eval pubDate="2014-04-30 11:27:49" | eval scrapeDate="2014-04-30 11:27:53" | eval ipubDate=strptime(pubDate, "%Y-%m-%d %H:%M:%S") | eval iscrapeDate=strptime(scrapeDate, "%Y-%m-%d %H:%M:%S") | eval lagtime=round(iscrapeDate-ipubDate,0) | table pubDate, scrapeDate, lagtime

Re: create lagtime panel with average time between two string value datetime fields

jdepp — Tue, 13 May 2014 22:35:46 GMT

I tried the following:
search sourcetype="data.newIndex.stats" | eval ipubDate=strptime(pubDate, "%Y-%m-%d %H:%M:%S") | eval iscrapeDate=strptime(scrapeDate, "%Y-%m-%d %H:%M:%S") | eval lagtime=round(iscrapeDate-ipubDate,0) | table pubDate, scrapeDate, lagtime

I used a dial gauge on my panel but get the following message:
These results may be truncated. This visualization is configured to display a maximum of 1000 results per series, and that limit h

I would like the above query to only return the max result

Re: create lagtime panel with average time between two string value datetime fields

richgalloway — Wed, 14 May 2014 15:21:31 GMT

Try this:

sourcetype="data.newIndex.stats" | eval ipubDate=strptime(pubDate, "%Y-%m-%d %H:%M:%S") | eval iscrapeDate=strptime(scrapeDate, "%Y-%m-%d %H:%M:%S") | eval lagtime=round(iscrapeDate-ipubDate,0) | chart max(lagtime)