https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-durations-between-1-start-event-and/m-p/153955#M43251 <P>Work perfectly, thank you <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 04 Aug 2015 14:28:31 GMT collier31200 2015-08-04T14:28:31Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-durations-between-1-start-event-and/m-p/153952#M43248 <P>Hello all,</P> <P>How do I get the time between one start event and multiple end events?</P> <P>Let me explain: <BR /> I have one start event and multiple end events and I need to see the duration between the start event and each of the end events.<BR /> Currently I'm using the following search, but only raised the duration between the start event and the first end event.<BR /> This search correctly displays all the other occurrences of end events, but without the durations <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> <PRE><CODE>my search | transaction startswith="Status update" endswith="Mount" keepevicted=t | sort 0 _time | table _time Update Mounted duration _raw </CODE></PRE> <P>Please helppp !! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 04 Aug 2015 13:33:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-durations-between-1-start-event-and/m-p/153952#M43248 collier31200 2015-08-04T13:33:21Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-durations-between-1-start-event-and/m-p/153953#M43249 <P>What about something like this instead:</P> <PRE><CODE>... | eval start_time=if(searchmatch("Status update"),_time,null()) | streamstats last(start_time) as last_start_time | eval duration=_time-last_start_time | search "Mount" </CODE></PRE> <P>1) We create a field start_time which if we have a start event (check out <A href="http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/CommonEvalFunctions">Eval Functions</A> ), we set to the _time of the event, otherwise we don't set it at all.<BR /> 2) We then use <A href="http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/streamstats">streamstats</A> to get the most recent start time for each event<BR /> 3) We then keep only the ending events</P> Tue, 04 Aug 2015 13:47:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-durations-between-1-start-event-and/m-p/153953#M43249 acharlieh 2015-08-04T13:47:15Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-durations-between-1-start-event-and/m-p/153954#M43250 <P>Assuming your transaction has another correlation field (e.g. a mountpoint/directory-name) which you did not specify (a big "if", I know), you can do it like this:</P> <PRE><CODE>... | eventstats earliest(_time) AS StartTime by correlationID | search "Mount" | eval duration=_time-StartTime | table _time Update Mounted duration _raw </CODE></PRE> Tue, 04 Aug 2015 13:55:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-durations-between-1-start-event-and/m-p/153954#M43250 woodcock 2015-08-04T13:55:25Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-durations-between-1-start-event-and/m-p/153955#M43251 <P>Work perfectly, thank you <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 04 Aug 2015 14:28:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-durations-between-1-start-event-and/m-p/153955#M43251 collier31200 2015-08-04T14:28:31Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-durations-between-1-start-event-and/m-p/153956#M43252 <P>My transaction has not another correlation field :S..<BR /> But thank you, this search will help for other stuff <span class="lia-unicode-emoji" title=":grinning_face_with_smiling_eyes:">😄</span></P> Tue, 04 Aug 2015 14:31:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-durations-between-1-start-event-and/m-p/153956#M43252 collier31200 2015-08-04T14:31:14Z