Splunk Enterprise

Capture Status Change

vishaltaneja070
Motivator

I have data like this:
Status              EndTime        StartTime
Pending           25-06-2020      24-06-2020
Pending           24-06-2020      23-06-2020
New              23-06-2020      22-06-2020
Pending          22-06-2020      21-06-2020
Pending           21-06-2020      20-06-2020
OLD               20-06-2020      19-06-2020
OLD              19-06-2020      18-06-2020
NEW              18-6-2020       17-06-2020

I need to capture the date change and start and end time of Status change. So output should be like:

Pending 25-06-2020 23-06-2020
New 23-06-2020 22-06-2020
Pending 22-06-2020 20-06-2020
OLD  20-06-2020 18-06-2020
NEW     18-6-2020     17-06-2020

can somebody please help?

 

 

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Try this

| makeresults
| eval _raw="STATUS ENDTIME STARTTIME
Pending 25-06-2020 24-06-2020
Pending 24-06-2020 23-06-2020
New 23-06-2020 22-06-2020
Pending 22-06-2020 21-06-2020
Pending 21-06-2020 20-06-2020
OLD 20-06-2020 19-06-2020
OLD 19-06-2020 18-06-2020
NEW 18-6-2020 17-06-2020"
| multikv
| fields - _raw _time
| eval start=strptime(STARTTIME, "%d-%m-%Y"), end=strptime(ENDTIME, "%d-%m-%Y")
| streamstats reset_on_change=t min(start) as start max(end) as end by STATUS
| stats min(start) as start by STATUS, end
| sort - end
| eval start=strftime(start, "%F"), end=strftime(end, "%F")

You example data setup  is up to the fields - _raw _time

Hope this helps

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Try this

| makeresults
| eval _raw="STATUS ENDTIME STARTTIME
Pending 25-06-2020 24-06-2020
Pending 24-06-2020 23-06-2020
New 23-06-2020 22-06-2020
Pending 22-06-2020 21-06-2020
Pending 21-06-2020 20-06-2020
OLD 20-06-2020 19-06-2020
OLD 19-06-2020 18-06-2020
NEW 18-6-2020 17-06-2020"
| multikv
| fields - _raw _time
| eval start=strptime(STARTTIME, "%d-%m-%Y"), end=strptime(ENDTIME, "%d-%m-%Y")
| streamstats reset_on_change=t min(start) as start max(end) as end by STATUS
| stats min(start) as start by STATUS, end
| sort - end
| eval start=strftime(start, "%F"), end=strftime(end, "%F")

You example data setup  is up to the fields - _raw _time

Hope this helps

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...