topic For all occurences, get the duration of a value dropping below a threshhold in Splunk Search https://community.splunk.com/t5/Splunk-Search/For-all-occurences-get-the-duration-of-a-value-dropping-below-a/m-p/315341#M94405 <P>I have events that show signal strength. What I want to do is determine the start_time, end_time and duration of any period where the signal strength drops below what is considered 'normal'. My events have two different signals: signal_id=1 and signal_id=2.</P> <P>Example event:<BR /> _time, signal_id, signal_strength, normal_signal<BR /> 2017-05-16 16:17:28, 1,17.38,14.28</P> <P>Output I'd like to see:<BR /> start_time,end_time,duration,signal_id</P> Tue, 29 Sep 2020 14:13:57 GMT jpass 2020-09-29T14:13:57Z For all occurences, get the duration of a value dropping below a threshhold https://community.splunk.com/t5/Splunk-Search/For-all-occurences-get-the-duration-of-a-value-dropping-below-a/m-p/315341#M94405 <P>I have events that show signal strength. What I want to do is determine the start_time, end_time and duration of any period where the signal strength drops below what is considered 'normal'. My events have two different signals: signal_id=1 and signal_id=2.</P> <P>Example event:<BR /> _time, signal_id, signal_strength, normal_signal<BR /> 2017-05-16 16:17:28, 1,17.38,14.28</P> <P>Output I'd like to see:<BR /> start_time,end_time,duration,signal_id</P> Tue, 29 Sep 2020 14:13:57 GMT https://community.splunk.com/t5/Splunk-Search/For-all-occurences-get-the-duration-of-a-value-dropping-below-a/m-p/315341#M94405 jpass 2020-09-29T14:13:57Z Re: For all occurences, get the duration of a value dropping below a threshhold https://community.splunk.com/t5/Splunk-Search/For-all-occurences-get-the-duration-of-a-value-dropping-below-a/m-p/315342#M94406 <P>Like this:</P> <PRE><CODE>Your Base Search Here | streamstats count(eval(signal_strength&gt;=normal_signal)) AS sessionID BY signal_id | stats min(_time) AS start_time max(_time) AS end_time range(_time) AS duration count AS numEvents BY signal_id sessionID | search numEvents&gt;1 </CODE></PRE> Tue, 23 May 2017 14:13:33 GMT https://community.splunk.com/t5/Splunk-Search/For-all-occurences-get-the-duration-of-a-value-dropping-below-a/m-p/315342#M94406 woodcock 2017-05-23T14:13:33Z Re: For all occurences, get the duration of a value dropping below a threshhold https://community.splunk.com/t5/Splunk-Search/For-all-occurences-get-the-duration-of-a-value-dropping-below-a/m-p/315343#M94407 <P>Yes thank you much.</P> Tue, 23 May 2017 15:11:10 GMT https://community.splunk.com/t5/Splunk-Search/For-all-occurences-get-the-duration-of-a-value-dropping-below-a/m-p/315343#M94407 jpass 2017-05-23T15:11:10Z