Splunk Enterprise Security
Highlighted

In Splunk Enterprise Security, how do you calculate the time difference from different events with the same value for other field?

New Member

Hello,

I'm trying to figure out a search that will parse through all events from a specific sourcetype.

For each unique value from a field (for example users=example), I want to calculate and display in a new column the time difference between the oldest and the newest event (field name is _time).

Here is what I've been trying to do and doesn't work.

user=* action=failure |foreach user [eval dif=max(_time)-min(_time)] | table user , dif , src
0 Karma
Highlighted

Re: In Splunk Enterprise Security, how do you calculate the time difference from different events with the same value for other field?

SplunkTrust
SplunkTrust

Try this query.

index=foo sourcetype=bar | stats range(_time) as dif by field | table field, dif
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: In Splunk Enterprise Security, how do you calculate the time difference from different events with the same value for other field?

Communicator

yours is much simpler though

0 Karma
Highlighted

Re: In Splunk Enterprise Security, how do you calculate the time difference from different events with the same value for other field?

Communicator

Hello,
Try this query (After you will adjust it to you data of course) :

index=_internal sourcetype=splunkd 
| fields log_level 
| stats dc by log_level
| map search="search index=_internal sourcetype=splunkd log_level=$log_level$ | stats min(_time) 
as min max(_time) as max by log_level | eval diff=(max-min)/86400 | fields diff log_level"

log_level = users

Regards

0 Karma