There are more than 600+ store each having 50+ machines. The query i used is
storeNo="*" | table machineId,storeId,_time | sort 0 machineId,_time | streamstats window=1 current=f global=f values(_time) as next_seq by machineId | eval diff = tostring(_time - next_seq,"duration") | eval days=if(match(diff,"\+"),replace(diff,"(\d+)(\+.*)","\1"),0)
It works fine with 1 or 2 stores. However the problem occurs when i run it across all stores. The final result tends to leave out some information/values from the final table. I suspect a memory issue but not sure.
I am a month old to Splunk and learning. Can you help me out here by suggesting any alternative method like iteration/looping or any methods where i can consume less memory.
Give this a try
storeNo="*" | table machineId,storeId,_time | streamstats window=1 current=f global=f values(_time) as next_seq by machineId | eval diff = abs(_time - next_seq) | eval days=floor(diff/86400)
The timestamp between successive logs received for each machine in a store. I need to do a difference between these two time and find if it is greater than say 30 days, indicating the machine has been offline for that period.