Splunk Dev

calculate duration between events and show events with specific duration

sarit_s
Communicator

Hello

i have a list of events and a fields called ClientDateTime 
i want to show the events the their ClientDateTime is 5s between one event to another
how can i do it ?

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

More information would be helpful, but is the general idea.  First, convert ClientDateTime into epoch form (using strptime).  Sort the events by the converted value.  Then use streamstats to compute the difference between adjacent events.  Finally, use where to filter out undesired values.

index=foo ClientDateTime=*
| eval ClientDT = strptime(ClientDateTime, "<<insert appropriate format string>>")
| sort + ClientDT
| streamstats window=2 range(ClientDT) as duration
| where duration > <<some-value>>
---
If this reply helps you, Karma would be appreciated.
0 Karma

sarit_s
Communicator

this is what i tried to do 

sourcetype=clientlogs AND Mode=Real AND Action="OpenPositionRequest" AND Request_Data_View_CurrentTradingMode="REGULAR" 
| eval ClientDT = strptime(ClientDateTime, "%Y-%m-%dT%H:%M:%S.%3NZ")
| sort + ClientDT
| streamstats window=2 range(ClientDT) as duration
|table ClientDT, duration

and here are the results :

sarit_s_0-1640787335377.png

 

how can i check if duration between events is 5s ?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The duration field value is in seconds.  Use the where command to filter for a specific value.

sourcetype=clientlogs AND Mode=Real AND Action="OpenPositionRequest" AND Request_Data_View_CurrentTradingMode="REGULAR" 
| eval ClientDT = strptime(ClientDateTime, "%Y-%m-%dT%H:%M:%S.%3NZ")
| sort + ClientDT
| streamstats window=2 range(ClientDT) as duration
| where duration = 5.000000
|table ClientDT, duration
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...