Splunk Search

Calculate difference of fields where certain field value exists

x213217
Explorer

For each Digit I have below (Digit 0,2,3,4,5,7,8) I want to calculate the difference in time between the TXN endtime and the FW endTime for that digit. How can i group this new calculated one value for each digit?

index=
jobName = (all job names here)
| lookup digit_processing.csv jobName as jobName output Digit as Digit
| eval endTimeEpoch = strptime(endTime, "%Y-%m-%d %H:%M:%S") 
| table jobName Digit endTime endTimeEpoch status 
| sort -Digit

alt text

Tags (1)
0 Karma
1 Solution

nickhills
Ultra Champion

extract the "digit" value
|rex field=Digit "Digit (?P<digitValue>\d)"

rewrite _time to be endTimeEpoch
|eval _time = endTimeEpoch

use transaction to group them
|transaction digitValue startswith=*FW endswith=*TXN

retable
| table jobName Digit digitValue endTime endTimeEpoch status duration

So in full:

index=
jobName = (all job names here)
| lookup digit_processing.csv jobName as jobName output Digit as Digit
| eval endTimeEpoch = strptime(endTime, "%Y-%m-%d %H:%M:%S") 
| rex field=Digit "Digit (?P<digitValue>\d)"
| eval _time = endTimeEpoch
| transaction digitValue startswith=*FW endswith=*TXN
| table jobName Digit digitValue endTime endTimeEpoch status duration
| sort -Digit
If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

nickhills
Ultra Champion

extract the "digit" value
|rex field=Digit "Digit (?P<digitValue>\d)"

rewrite _time to be endTimeEpoch
|eval _time = endTimeEpoch

use transaction to group them
|transaction digitValue startswith=*FW endswith=*TXN

retable
| table jobName Digit digitValue endTime endTimeEpoch status duration

So in full:

index=
jobName = (all job names here)
| lookup digit_processing.csv jobName as jobName output Digit as Digit
| eval endTimeEpoch = strptime(endTime, "%Y-%m-%d %H:%M:%S") 
| rex field=Digit "Digit (?P<digitValue>\d)"
| eval _time = endTimeEpoch
| transaction digitValue startswith=*FW endswith=*TXN
| table jobName Digit digitValue endTime endTimeEpoch status duration
| sort -Digit
If my comment helps, please give it a thumbs up!
0 Karma

x213217
Explorer

Thank you!

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...