topic Find Time-Range for Most Recent event. in Splunk Search

Find Time-Range for Most Recent event.

njwrk — Sun, 02 Apr 2017 05:53:11 GMT

So I have splunk events and I want to display information as a time range. For example:
event type1: Started proc1 id=123
event type2: Stoped proc1 id=123
(Assume id 123 is associated with proc1)
So I want to display the time duration for which proc1 ran most recently. I have following splunk query:
index | search "started" OR "Stopped" | where id=123 | sort - _time | head 2

This gives me the 2 events which I'am interested in. But how can I extract the _time from both events?

Re: Find Time-Range for Most Recent event.

niketn — Sun, 02 Apr 2017 13:16:37 GMT

You can easily create a transaction with id as if transaction id and startswith and endswith criteria as *Started* and *Stopped* respectively. Transaction command automatically generates the correlated eventcount and duration between the events. However, stats will be faster and better alternative in this scenario. Please give following a try:

index=<YourIndexName> "Started" OR "Stopped" id=*
| eval Status=if(searchmatch("Started"),"Started","Stopped")
| stats count as eventcount values(Status) as Status min(_time) as MinTime max(_time) as MaxTime by id
| search eventcount>1 Status="Started" Statsus="Stopped"
| eval duration=MaxTime-MinTime
| eval _time=MinTime
| fieldformat MinTime=strftime(MinTIme,"%c")
| fieldformat MaxTime=strftime(MaxTIme,"%c")
| table _time Status id duration MinTime MaxTime

If you want to find transactions which have started but not stopped you can change the search criteria accordingly.

Re: Find Time-Range for Most Recent event.

niketn — Sun, 02 Apr 2017 20:21:55 GMT

@njwrk Please accept the answer if this has helped.

Re: Find Time-Range for Most Recent event.

woodcock — Mon, 03 Apr 2017 04:39:20 GMT

Like this:

index=YourIndexHere sourcetype=YourSourcetypeHere started OR stopped | stats range(_time) AS duration BY id