Getting Data In

How calculate the delta between the timestamp in one row with the timestamp in the previous row for all results?

Brigno
New Member

Hi,

In my search result, I have a series of events. I am able to calculate the delta of the various _time timestamps between each event, but how can I calculate the delta dividing the result in pairs? For example, I have 6 timestamps:

1 - 22/02/16 14:50:00.000
2 - 22/02/16 14:50:30.000
3 - 22/02/16 14:50:38.000
4 - 22/02/16 14:50:59.000
5 - 22/02/16 14:53:06.000
6 - 22/02/16 14:54:00.000
...

I need the delta between line 1 and line 2, then between line 3 and line 4, and so on for the entire result. Someone knows how to do something like this?

0 Karma

woodcock
Esteemed Legend

Like this:

Your Base Search Here
| streamstats count AS serial
| eval copy_time=if(serial%2==1, _time, null())
| streamstats current=f last(copy_time) AS last_time
| eval delta = if(isnull(copy_time), tostring(last_time - _time, "duration"), null())
0 Karma

Stevelim
Communicator

Have you considered the Delta command?

[your search] | delta _time as OnSince  | eval OnSince = tostring (OnSince, "duration")
0 Karma

Brigno
New Member

Yes, I do. I know it, but it's not what I'm looking for. That command make a delta between line 1-2, 2-3, 3-4. 4-5 and so on, but what I really need is a delta between lines 1-2, 3-4, 5-6 etc.

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...