Calculating time difference between two fields of the same name in two sourcetypes

[asarolkar]

All,

I have two logs with sourcetype="alphalog" and sourcetype="betalog" with the generic timestamp _time present.

I am joining them on a field called accountId.

What I want to do is to be able to find the difference between the "_time" values if possible ?

How do I find the time difference (epoch time is fine too) between two _time values in two difference log files ?

[alacercogitatus · Accepted solution]

Although it might not be the fastest, you can use "transaction".

sourcetype="alphalog" OR sourcetype="betalog" | transaction accountId maxspan=10m| timechart duration by accountId

Transaction calculates the duration in seconds for each transaction.

You can also do a stats and eval:

sourcetype="alphalog" OR sourcetype="betalog" | stats latest(_time) as lt earliest(_time) as et by accountId| eval duration = lt - et| table duration accountID

[kallu]

It's all in manuals 🙂

Let's say you have a set of events where the IP address is extracted to either clientip or ipaddress. This example defines a new field called ip, that takes the value of either clientip or ipaddress, depending on which is not NULL (exists in that event):

... | eval ip=coalesce(clientip,ipaddress)

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

[asarolkar]

Hi,

I have a stupid question for followup 🙂 !

What if the field was named accountNumber in alphalog and accountId in betalog, how would the searches that you suggested change (obviously a join is involved)