Splunk Enterprise

How to check time difference between a series of events?

sh254087
Communicator

Hello!

I am trying to find system uptime and here's the scenario:

The monitoring/status check log returns fields like - InstanceID, timestamp, Count.

There's a status check event every 5mins. System is up when 'Count >=5' and down otherwise. 

Looking to know how I can come up with the Downtime value either in actual time as mentioned in sample data in the table or in seconds.

Can someone please help with this?

InstanceIDtimestampSampleCountDifferenceDowntime
insA2023-02-21T16:00:00Z50 
insA2023-02-21T16:05:00Z40 
insA2023-02-21T16:10:00Z200:05 
insA2023-02-21T16:15:00Z500:1000:10
insA2023-02-21T16:20:00Z50 
insA2023-02-21T16:25:00Z50 
insA2023-02-21T16:30:00Z40 
insA2023-02-22T01:35:00Z209:05 
insA2023-02-22T01:40:00Z509:1009:10
insA2023-02-22T01:45:00Z50 
insA2023-02-22T01:50:00Z50 
insA2023-02-22T01:55:00Z50 
insA2023-02-22T02:00:00Z50 
insA2023-02-22T02:05:00Z50 
insA2023-02-22T02:10:00Z40 
insA2023-02-22T02:15:00Z300:05 
insA2023-02-22T02:20:00Z500:1000:10
insA2023-02-22T02:25:00Z50 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Assuming already in time order, you could try something like this

| eval up=if(SampleCount >= 5, 1, null())
| streamstats window=2 global=f range(_time) as diff by up InstanceID
| eval downtime=if(diff-300>0,tostring(diff-300,"duration"),null())

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Assuming already in time order, you could try something like this

| eval up=if(SampleCount >= 5, 1, null())
| streamstats window=2 global=f range(_time) as diff by up InstanceID
| eval downtime=if(diff-300>0,tostring(diff-300,"duration"),null())

sh254087
Communicator

@ITWhisperer This just did it for me. Thanks a lot.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...