topic Re: avoid latest timestamp in Splunk Search

avoid latest timestamp

arjitgoswami — Thu, 01 Jun 2017 09:07:58 GMT

Hi Team,

There is a scenario where I need to calculate time range. I have to ignore latest timestamp and need to calculate the time range for remaining records.

for eg..

17/05/2017 15:56:27.065 XXXX................
17/05/2017 15:46:27.065 YYYYY.................
17/05/2017 15:36:27.065 ZZZZZ........

so it should give me 10 mins instead of 20 mins.

can you please help? Can you please suggest how can I do that?

Thanks and regards,
Arjit goswami.

Re: avoid latest timestamp

dineshraj9 — Thu, 01 Jun 2017 09:29:32 GMT

You can filter the first event by doing a streamstats and removing event with count=1 and then take the difference between the min and max time -

 <base search>   | streamstats count | where count!=1 | eval time=round(_time) | stats max(time) as max_time,min(time) as min_time | eval diff(mins)=strftime(max_time-min_time,"%M")

Re: avoid latest timestamp

niketn — Thu, 01 Jun 2017 10:01:07 GMT

@arjitgoswami, can you add your existing search?