Deployment Architecture

Using clustering to calculate start and end of a process


Hi all

I have some events which represent something like a ping.

For example :
_time: a time stamp
doing it: 1
database: db1
server: server1

so i get something like this:

alt text

the color represent the DB.
Now, what i need to do is to write a query which understands that there are 2 groups of events for the violet db and that gives me that _time of the first event and the rime od the last event of every group, like in the next image.

alt text

I think this can be achieved using clustering, just i dont know how (maybe with k means method).

Can you help me?

0 Karma

Esteemed Legend

Like this:

... | transaction max_pause=5m database server | eval start = _time, end = _time + duration
0 Karma

Revered Legend

Give transaction command a try.

your base search | transaction database server | eval start=_time | eval end=_time+duration
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!