Monitoring Splunk

How do you calculate time taken by process with date and generate a report from it where input is a log file?

shubhambhagat02
New Member

My log file is like
02/04/2018 - 06:27:23 --- process 1 started
02/04/2018 - 06:28:23 --- process 1 completed
02/04/2018 - 06:28:23 --- backup initiated
02/04/2018 - 06:30:23 --- mail sent
02/04/2018 - 06:31:23 --- 'back up completed

I want to calculate time taken by " backup initiated" to "back up completed" with date. I want to generate a report for date and time taken by the process.

Tags (1)
0 Karma
1 Solution

renjith_nair
Legend

@shubhambhagat02

If you do not have a common field for each events to denote a start//finish, try using transaction

your searches | transaction startswith="backup initiated" endswith="back up completed" maxspan=10m

Above gives you a "duration". Maxspan should be changed according to your process durations

OR

If there are only two events in a day, then set the time rande to that day and

search "backup*"|stats earliest(_time) as backup_start_time,latest(_time) as backup_end_time|eval duration=backup_end_time-backup_start_time
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

@shubhambhagat02

If you do not have a common field for each events to denote a start//finish, try using transaction

your searches | transaction startswith="backup initiated" endswith="back up completed" maxspan=10m

Above gives you a "duration". Maxspan should be changed according to your process durations

OR

If there are only two events in a day, then set the time rande to that day and

search "backup*"|stats earliest(_time) as backup_start_time,latest(_time) as backup_end_time|eval duration=backup_end_time-backup_start_time
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...