Splunk Dev

calculate duration between events and show events with specific duration

sarit_s
Communicator

Hello

i have a list of events and a fields called ClientDateTime 
i want to show the events the their ClientDateTime is 5s between one event to another
how can i do it ?

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

More information would be helpful, but is the general idea.  First, convert ClientDateTime into epoch form (using strptime).  Sort the events by the converted value.  Then use streamstats to compute the difference between adjacent events.  Finally, use where to filter out undesired values.

index=foo ClientDateTime=*
| eval ClientDT = strptime(ClientDateTime, "<<insert appropriate format string>>")
| sort + ClientDT
| streamstats window=2 range(ClientDT) as duration
| where duration > <<some-value>>
---
If this reply helps you, Karma would be appreciated.
0 Karma

sarit_s
Communicator

this is what i tried to do 

sourcetype=clientlogs AND Mode=Real AND Action="OpenPositionRequest" AND Request_Data_View_CurrentTradingMode="REGULAR" 
| eval ClientDT = strptime(ClientDateTime, "%Y-%m-%dT%H:%M:%S.%3NZ")
| sort + ClientDT
| streamstats window=2 range(ClientDT) as duration
|table ClientDT, duration

and here are the results :

sarit_s_0-1640787335377.png

 

how can i check if duration between events is 5s ?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The duration field value is in seconds.  Use the where command to filter for a specific value.

sourcetype=clientlogs AND Mode=Real AND Action="OpenPositionRequest" AND Request_Data_View_CurrentTradingMode="REGULAR" 
| eval ClientDT = strptime(ClientDateTime, "%Y-%m-%dT%H:%M:%S.%3NZ")
| sort + ClientDT
| streamstats window=2 range(ClientDT) as duration
| where duration = 5.000000
|table ClientDT, duration
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...