Getting Data In

Remove identical events and keep the latest in the dashboard without using dedup

sai91603
Engager

Hi ,

I am creating a dashboard where it should show the time difference between two latest events, since all the events look alike, I do not want splunk to pickup the old events timestamps and compare with the new one.

I tried using dedup and it is showing only for one particular day even though I selected a range of dates.

Query:

index=i01_prd  ("ProcessBatch" AND "Total Processed") OR (ProcessBatch BEGIN - ProcessBatch.doWork)
| bucket _time span=1d as day
| stats earliest(_time) as First latest(_time) as Last by day
| eval DurationInMinutesDeci=round((Last - First))
| eval day=strftime(day,"%m/%d/%y")
| eval Last=strftime(Last,"%S")
| eval First=strftime(First,"%S")
| rename Last as "Last_ss"
| rename First as "First_ss"
| rename DurationInMinutesDeci as Seconds
| rename _time as exacttime
| rename day as _time
| table _time, Seconds

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
index=i01_prd  ("ProcessBatch" AND "Total Processed") OR (ProcessBatch BEGIN - ProcessBatch.doWork)
| sort _time
| streamstats window=1 current=false values(_time) as previous_time
| bucket _time span=1d as day
| stats latest(previous_time) as Previous latest(_time) as Last by day
| eval DurationInMinutesDeci=round((Last - Previous))
| eval day=strftime(day,"%m/%d/%y")
| rename DurationInMinutesDeci as Seconds
| rename day as _time
| table _time, Seconds

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Not entirely sure what you are trying to do here

index=i01_prd  ("ProcessBatch" AND "Total Processed") OR (ProcessBatch BEGIN - ProcessBatch.doWork)
| bucket _time span=1d as day
| stats earliest(_time) as First latest(_time) as Last by day
| eval DurationInMinutesDeci=round((Last - First))
| eval day=strftime(day,"%m/%d/%y")
| eval Last=strftime(Last,"%S")
| eval First=strftime(First,"%S")
| rename Last as "Last_ss"
| rename First as "First_ss"
| rename DurationInMinutesDeci as Seconds
| rename _time as exacttime
| rename day as _time
| table _time, Seconds

The highlighted line are the only ones which seem relevant. What you should be getting is the number of second between the first event of the day and the last event of the day for each day in the index which matches the search. Is this what you were expecting?

0 Karma

sai91603
Engager

Thanks for the response @ITWhisperer .
No, i need the time difference between the last two events(latest events). 
Means  if i have two  events in the morning, which is similar to two events in the afternoon, I need to calculate the time difference between the latest events(afternoon events)

I can provide you with the logs if you didn’t get it and thanks for correcting the query.

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=i01_prd  ("ProcessBatch" AND "Total Processed") OR (ProcessBatch BEGIN - ProcessBatch.doWork)
| sort _time
| streamstats window=1 current=false values(_time) as previous_time
| bucket _time span=1d as day
| stats latest(previous_time) as Previous latest(_time) as Last by day
| eval DurationInMinutesDeci=round((Last - Previous))
| eval day=strftime(day,"%m/%d/%y")
| rename DurationInMinutesDeci as Seconds
| rename day as _time
| table _time, Seconds
0 Karma

sai91603
Engager

Thanks @ITWhisperer ,it's working like a charm.

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...