topic Re: Calculate time difference between events for distinct users in transaction log in Splunk Search https://community.splunk.com/t5/Splunk-Search/Calculate-time-difference-between-events-for-distinct-users-in/m-p/299773#M90298 <P>There are a handful of ways. In addition to jeffland's answer above, you could also...</P> <PRE><CODE>... | transaction maxspan=1m User | search duration&gt;X </CODE></PRE> <P>That will group events with the same User (and not separated by more than 1 minute - adjust that) into a "set" of events. You then have a duration, eventcount, and other information.</P> <P>More performance (especially in a distributed environment) can be had by converting that to a stats command.</P> <PRE><CODE>... | stats max(_time) as Latest min(_time) as Earliest BY User | eval duration=Latest-Earliest | search duration&gt;X </CODE></PRE> <P>You'll like need a bit more <CODE>list(fieldname)</CODE> or 'values(fieldname)` in the stats command to get all your information out, but know it's possible. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>Links to docs on <A href="http://docs.splunk.com/Documentation/Splunk/6.6.2/SearchReference/Stats">stats</A> and the <A href="http://docs.splunk.com/Documentation/Splunk/6.6.2/SearchReference/CommonStatsFunctions">functions stats supports</A>, and finally <A href="http://docs.splunk.com/Documentation/Splunk/6.6.2/SearchReference/Transaction">transaction</A>.</P> Thu, 24 Aug 2017 12:53:17 GMT Richfez 2017-08-24T12:53:17Z Calculate time difference between events for distinct users in transaction log https://community.splunk.com/t5/Splunk-Search/Calculate-time-difference-between-events-for-distinct-users-in/m-p/299771#M90296 <P>Hi </P> <P>We are hitting a wall here... we would like to show events where a user does more than <EM>x</EM> actions within a small time window (1-3 seconds). </P> <P>The log looks like this:</P> <PRE><CODE>24.08.17;10:13:13|WebContainer : 36|DEBUG|User1|d.s.s.c.BaseController|SomeController.java:2269 - MyHandler: 561170, MyStep: 1801513, Action: ENVP, Timestamp: 2017-08-24-10.13.13.0018 24.08.17;10:13:14|WebContainer : 36|DEBUG|User1|d.s.s.c.BaseController|SomeController.java:2269 - MyHandler: 561170, MyStep: 1801513, Action: ENVP, Timestamp: 2017-08-24-10.13.13.0019 24.08.17;10:12:59|WebContainer : 37|DEBUG|User2|d.s.s.c.BaseController|SomeController.java:2269 - MyHandler: 561170, MyStep: 1801513, Action: SAVE, Timestamp: 2017-08-24-10.12.59.0595 24.08.17;10:12:55|WebContainer : 5|DEBUG|User2|d.s.s.c.BaseController|SomeController.java:2269 - MyHandler: 561170, MyStep: 1801513, Action: ENVP, Timestamp: 2017-08-24-10.12.55.0820 24.08.17;10:12:41|WebContainer : 0|DEBUG|A010999|d.s.s.c.BaseController|SomeController.java:2269 - MyHandler: 561170, MyStep: 1801513, Action: ENVP, Timestamp: 2017-08-24-10.12.40.0992 </CODE></PRE> <P>we want to filter out the events where the delta between those events are more that x seconds... for the distinct user. Like above: only user1 has events within 1 seconds.</P> <P>What we need now is something like:<BR /> User: EventCount relativetimdeltabetweenevents (might not be needed because its a filter condition)<BR /> User1 2 1 secs</P> <P>how can we do this?</P> Thu, 24 Aug 2017 10:20:45 GMT https://community.splunk.com/t5/Splunk-Search/Calculate-time-difference-between-events-for-distinct-users-in/m-p/299771#M90296 hgehrts_splunk 2017-08-24T10:20:45Z Re: Calculate time difference between events for distinct users in transaction log https://community.splunk.com/t5/Splunk-Search/Calculate-time-difference-between-events-for-distinct-users-in/m-p/299772#M90297 <P><CODE>streamstats</CODE> has a <CODE>time_window</CODE> attribute. With that, you have a sliding time window and can do a count by user and action (if that is what you need, otherwise you can just do a count by user). <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Streamstats">Docs here</A>.</P> Thu, 24 Aug 2017 12:41:40 GMT https://community.splunk.com/t5/Splunk-Search/Calculate-time-difference-between-events-for-distinct-users-in/m-p/299772#M90297 jeffland 2017-08-24T12:41:40Z Re: Calculate time difference between events for distinct users in transaction log https://community.splunk.com/t5/Splunk-Search/Calculate-time-difference-between-events-for-distinct-users-in/m-p/299773#M90298 <P>There are a handful of ways. In addition to jeffland's answer above, you could also...</P> <PRE><CODE>... | transaction maxspan=1m User | search duration&gt;X </CODE></PRE> <P>That will group events with the same User (and not separated by more than 1 minute - adjust that) into a "set" of events. You then have a duration, eventcount, and other information.</P> <P>More performance (especially in a distributed environment) can be had by converting that to a stats command.</P> <PRE><CODE>... | stats max(_time) as Latest min(_time) as Earliest BY User | eval duration=Latest-Earliest | search duration&gt;X </CODE></PRE> <P>You'll like need a bit more <CODE>list(fieldname)</CODE> or 'values(fieldname)` in the stats command to get all your information out, but know it's possible. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>Links to docs on <A href="http://docs.splunk.com/Documentation/Splunk/6.6.2/SearchReference/Stats">stats</A> and the <A href="http://docs.splunk.com/Documentation/Splunk/6.6.2/SearchReference/CommonStatsFunctions">functions stats supports</A>, and finally <A href="http://docs.splunk.com/Documentation/Splunk/6.6.2/SearchReference/Transaction">transaction</A>.</P> Thu, 24 Aug 2017 12:53:17 GMT https://community.splunk.com/t5/Splunk-Search/Calculate-time-difference-between-events-for-distinct-users-in/m-p/299773#M90298 Richfez 2017-08-24T12:53:17Z