Using the eval command, how do you calculate the time difference between two events WHERE the status value is different?

[jacqu3sy]

Hi,

There's probably a better function to use for this, but I think it could be done with an eval and where (I think anyway)...

I need to calculate the time difference between two events WHERE the status value is different. i.e;

event details          status         _time
event 1                       2              2019-03-25 00:01:00
event 2                       3              2019-03-25 00:31:00

I tried this, but it failed;

| eval time1=_time(where (like status="2")

any ideas?

[nickhills]

If there is something common between the events like a transaction_id you can use the 'transaction' statement, which calculates you a duration in ms.
https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/Transaction

...your search| transaction tx_id |eval dur_sec=round((duration/1000) ,0)

If you provide some more relevent data I can expand my example to fit your use case.

[jacqu3sy]

I didnt think about 'transaction', I'll take a look at that. Regarding data, I'm using the rule_id of an event taken from the enterprise security macro 'incident_review', which is common between the two events;

rule_id status AssignementTime
0FF72D78 2 1552985974.388964
0FF72D78 3 1552986403.234565

[nickhills]

Great, just try swapping 'tx_id' for 'rule_id' and see how that fits your needs.
Good luck!