Getting Data In

How to search the time difference between start and end events for each unique event ID?

Engager

I have a log file going to Splunk which indicates the start and end of an event for VM creation. For example, in the logs I see something like this:

6/15/2015 11:00:00 <unique ID 1> Start event
... other events...
6/15/2015 11:02:00 <unique ID 1> End event
... other events...
6/15/2015 11:04:00 <unique ID 2> Start event
... other events...
6/15/2015 11:05:00 <unique ID 2> End event

I want to be able to get the time difference between the start and end event for all unique events as given by "unique id X".

Another way of saying it is, for all unique ID's, do eval(endtimestamp - starttimestamp), and print out the time difference in table form. I'm struggling to figure out how to do this through Splunk though. Can anyone point me in the right direction?

0 Karma
1 Solution

Esteemed Legend

Like this (assuming you are already extracting Unique ID as UniqueID😞

... | stats earliest(_time) AS startTime latest(_time) AS endTime by UniqueID | eval DurationSeconds=(endTime - startTime)

View solution in original post

0 Karma

Esteemed Legend

Like this (assuming you are already extracting Unique ID as UniqueID😞

... | stats earliest(_time) AS startTime latest(_time) AS endTime by UniqueID | eval DurationSeconds=(endTime - startTime)

View solution in original post

0 Karma

Engager

Thanks. I'm still trying to get the uniqueid extracted as a field, then I'll give it a try.

0 Karma

Esteemed Legend

Try something like this:

... | rex "^\d+/\d+/\d+\s+\d+:\d+:\d+\s+(?<UniqueID>\S+)" | stats earliest(_time) AS startTime latest(_time) AS endTime by UniqueID | eval DurationSeconds=(endTime - startTime)

Engager

Working! Thanks for your help.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!