Splunk Enterprise Security

In Splunk Enterprise Security, how do you calculate the time difference from different events with the same value for other field?

eugenolteanu
New Member

Hello,

I'm trying to figure out a search that will parse through all events from a specific sourcetype.

For each unique value from a field (for example users=example), I want to calculate and display in a new column the time difference between the oldest and the newest event (field name is _time).

Here is what I've been trying to do and doesn't work.

user=* action=failure |foreach user [eval dif=max(_time)-min(_time)] | table user , dif , src
0 Karma

astatrial
Contributor

Hello,
Try this query (After you will adjust it to you data of course) :

index=_internal sourcetype=splunkd 
| fields log_level 
| stats dc by log_level
| map search="search index=_internal sourcetype=splunkd log_level=$log_level$ | stats min(_time) 
as min max(_time) as max by log_level | eval diff=(max-min)/86400 | fields diff log_level"

log_level = users

Regards

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this query.

index=foo sourcetype=bar | stats range(_time) as dif by field | table field, dif
---
If this reply helps you, an upvote would be appreciated.
0 Karma

astatrial
Contributor

yours is much simpler though

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!