Getting Data In

Remove identical events and keep the latest in the dashboard without using dedup

sai91603
Engager

Hi ,

I am creating a dashboard where it should show the time difference between two latest events, since all the events look alike, I do not want splunk to pickup the old events timestamps and compare with the new one.

I tried using dedup and it is showing only for one particular day even though I selected a range of dates.

Query:

index=i01_prd  ("ProcessBatch" AND "Total Processed") OR (ProcessBatch BEGIN - ProcessBatch.doWork)
| bucket _time span=1d as day
| stats earliest(_time) as First latest(_time) as Last by day
| eval DurationInMinutesDeci=round((Last - First))
| eval day=strftime(day,"%m/%d/%y")
| eval Last=strftime(Last,"%S")
| eval First=strftime(First,"%S")
| rename Last as "Last_ss"
| rename First as "First_ss"
| rename DurationInMinutesDeci as Seconds
| rename _time as exacttime
| rename day as _time
| table _time, Seconds

Labels (1)
0 Karma
1 Solution

ITWhisperer
Legend
index=i01_prd  ("ProcessBatch" AND "Total Processed") OR (ProcessBatch BEGIN - ProcessBatch.doWork)
| sort _time
| streamstats window=1 current=false values(_time) as previous_time
| bucket _time span=1d as day
| stats latest(previous_time) as Previous latest(_time) as Last by day
| eval DurationInMinutesDeci=round((Last - Previous))
| eval day=strftime(day,"%m/%d/%y")
| rename DurationInMinutesDeci as Seconds
| rename day as _time
| table _time, Seconds

View solution in original post

0 Karma

ITWhisperer
Legend

Not entirely sure what you are trying to do here

index=i01_prd  ("ProcessBatch" AND "Total Processed") OR (ProcessBatch BEGIN - ProcessBatch.doWork)
| bucket _time span=1d as day
| stats earliest(_time) as First latest(_time) as Last by day
| eval DurationInMinutesDeci=round((Last - First))
| eval day=strftime(day,"%m/%d/%y")
| eval Last=strftime(Last,"%S")
| eval First=strftime(First,"%S")
| rename Last as "Last_ss"
| rename First as "First_ss"
| rename DurationInMinutesDeci as Seconds
| rename _time as exacttime
| rename day as _time
| table _time, Seconds

The highlighted line are the only ones which seem relevant. What you should be getting is the number of second between the first event of the day and the last event of the day for each day in the index which matches the search. Is this what you were expecting?

0 Karma

sai91603
Engager

Thanks for the response @ITWhisperer .
No, i need the time difference between the last two events(latest events). 
Means  if i have two  events in the morning, which is similar to two events in the afternoon, I need to calculate the time difference between the latest events(afternoon events)

I can provide you with the logs if you didn’t get it and thanks for correcting the query.

 

0 Karma

ITWhisperer
Legend
index=i01_prd  ("ProcessBatch" AND "Total Processed") OR (ProcessBatch BEGIN - ProcessBatch.doWork)
| sort _time
| streamstats window=1 current=false values(_time) as previous_time
| bucket _time span=1d as day
| stats latest(previous_time) as Previous latest(_time) as Last by day
| eval DurationInMinutesDeci=round((Last - Previous))
| eval day=strftime(day,"%m/%d/%y")
| rename DurationInMinutesDeci as Seconds
| rename day as _time
| table _time, Seconds

View solution in original post

0 Karma

sai91603
Engager

Thanks @ITWhisperer ,it's working like a charm.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.