Splunk Enterprise

How to find the duration in minutes between two events from _time ?

mihir_hardas
Explorer

How to find the duration in minutes between two events from _time ?

 
index=log-13120-nonprod-c laas_appId=qbmp.prediction* "pushed to greenplum for predictionId"
2022-05-19 03:37:30,108 jobRunStats INFO Current Predictions, total=1659262 pushed to greenplum for predictionId = fe387967-2f11-4358-8b27-c51a45042e79
2022-05-19 03:26:29,085 jobRunStats INFO Current Predictions, total=1659262 pushed to greenplum for predictionId = 473866d5-c7b1-4156-90a0-de978b260e8d
 
I simply want diff between the above two and then show a line graph of cycle time length in minutes.
So then output will be 
11mins
14mins
7 mins 

And then I want to plot a line graph that will tell me length of my cycle time 
 
I do not want to use transation
Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

 

| sort 0 _time
| streamstats window=2 range(_time) as timediff
| eval timediffmins=timediff/60

 

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

 

| sort 0 _time
| streamstats window=2 range(_time) as timediff
| eval timediffmins=timediff/60

 

0 Karma

mihir_hardas
Explorer

Yes this works ! Many thanks 

0 Karma
Get Updates on the Splunk Community!

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

[Coming Soon] Splunk Observability Cloud - Enhanced navigation with a modern look and ...

We are excited to introduce our enhanced UI that brings together AppDynamics and Splunk Observability. This is ...