Archive

Duration of two events by status!

Explorer

hi,
my raw data look like this:

12:01:11:000 ip: "123.456.789" = "1"
12:01:12:000 ip: "123.456.789" = "1"
12:01:13:000 ip: "123.456.789" = "1"
12:01:14:000 ip: "123.456.789" = "2"
12:01:15:000 ip: "123.456.789" = "2"
12:01:16:000 ip: "123.456.789" = "1"
12:01:17:000 ip: "123.456.789" = "1"

Now i want to calculate the duration only between the first event of "1" and "2". In other words, the duration when the ip shows the status "1". I tried some transaction and streamstats commands but nothing worked properly.

Thanks for your help!

Tags (1)
0 Karma
1 Solution

You could try with the transaction command:

index=<your_index> sourcetype=<your_sourcetype>
| transaction ip endswith=value=2
| eval keep=mvfilter(match(value, "1"))
| where keep=1

Assuming you are extracting the ip under field "ip" and values 1/2 under field "value"

View solution in original post

Motivator

(I loaded your sample data into my test box then I did a field extraction for the IP and another for CODE.)

index=main sourcetype=reschal2 | sort _time
| table _time, CODE
| streamstats range(_time) as DURATION by CODE reset_on_change=true

Those commands will show you how long it was "1", then "2" then "1" again.

Here are some screenshots....

alt text

Motivator

Don't know why the screenshot isn't displaying and the site won't let me upload another. 😞

0 Karma

Revered Legend

I would change | sort _time to | sort 0 _time in order to avoid it to be truncated after 10K rows (default limit).

Revered Legend

You can probably do this by using reverse and dedup command. Are both ip and status an extracted fields? If yes, something like this would work.

your base search | reverse | dedup ip status | stats range(_time) by ip
0 Karma

You could try with the transaction command:

index=<your_index> sourcetype=<your_sourcetype>
| transaction ip endswith=value=2
| eval keep=mvfilter(match(value, "1"))
| where keep=1

Assuming you are extracting the ip under field "ip" and values 1/2 under field "value"

View solution in original post

Explorer

Thank you. Your answer works great. By adding

|table _time duration |eval duration=tostring(duration,"duration")| sort -_time

i get a proper solution!

0 Karma

Yea, i forgot to mention duration would be stored under duration field, that's great you found it!

Thanks for accepting my answer and happy Splunking!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!