https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-total-duration-for-periods/m-p/229663#M68029 <P>How frequently are the events logged and do is active vs inactive determined? Assuming the events logged are only when the user is active, you can try something like this</P> <PRE><CODE>... | stats earliest(_time) as start latest(_time) as end by USER_ID | eval duration=tostring(round(end-start, 0), "duration") </CODE></PRE> <P>If events are logged for active as well as inactive state, try this</P> <PRE><CODE>... state="active" | stats earliest(_time) as start latest(_time) as end by USER_ID | eval duration=tostring(round(end-start, 0), "duration")** </CODE></PRE> Tue, 16 Aug 2016 08:13:21 GMT sundareshr 2016-08-16T08:13:21Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-total-duration-for-periods/m-p/229662#M68028 <P>Looking for help coming up with search to calculate the total duration there were events in a given time period - essentially a reflection (for the given use case) for how much time the user was actively doing something. </P> <P>So if user A logged in at 11 am, did 5 things between 11 and 11:01, nothing between 11:01 and 11:03 and then again between 11:03 and 11:04 did 10 things, 11:04 to 11:05 did 3 things, then in total the user was active for 3 out of the 5 mins. Only care about 1 minute granularity.</P> <P>I'm using transaction with maxpause of 60s to represent "inactivity" for a certain time period and then aggregate "duration" to get active_time </P> <PRE><CODE>| transaction USER_ID maxpause=65s | stats sum(duration) as dur | eval active_time = dur/60 </CODE></PRE> <P>Looking for other ideas and techniques to approach this.</P> Tue, 16 Aug 2016 04:22:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-total-duration-for-periods/m-p/229662#M68028 aladda_splunk 2016-08-16T04:22:58Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-total-duration-for-periods/m-p/229663#M68029 <P>How frequently are the events logged and do is active vs inactive determined? Assuming the events logged are only when the user is active, you can try something like this</P> <PRE><CODE>... | stats earliest(_time) as start latest(_time) as end by USER_ID | eval duration=tostring(round(end-start, 0), "duration") </CODE></PRE> <P>If events are logged for active as well as inactive state, try this</P> <PRE><CODE>... state="active" | stats earliest(_time) as start latest(_time) as end by USER_ID | eval duration=tostring(round(end-start, 0), "duration")** </CODE></PRE> Tue, 16 Aug 2016 08:13:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-total-duration-for-periods/m-p/229663#M68029 sundareshr 2016-08-16T08:13:21Z