If I run a simple search:
Index=*
It displays each event with columns as time, then the event.
Is there a way to configure Splunk also to display another column called "Delta Time" which shows time difference from previous event?
This will help to eyeball quickly the time gap.
Thanks.
Yes you can, although this can add quite a bit of overhead to your search, depending on the number of results. And the search "index=*" is also an expensive search, unless you are in a small environment or your timerange is very short.
index=*
| delta _time p=1 as delta_time
| eval delta_time = tostring(delta_time,"duration")
| table _time, delta_time, _raw
Notice that your delta time will always be negative, because Splunk shows the most recent events first.
(Updated to correct typo in line 3 of the search)
Thanks for posting the answer.
In the above posting, I removed line 3 which caused error.
index=* My_TXN_ID
| delta _time p=1 as delta_time
| table _time, delta_time, _raw
Now it works.
Is there a way to also display the sequence number, and show the message not as "_raw" but formatted as normal search result?
Thanks.
Ok, I know how to add sequence number.
How to format the message "_raw" as normal search display?
index=* My_TXN_ID
| delta _time p=1 as delta_time
|streamstats count as seq_num
| table seq_num _time, delta_time, _raw
I don't know what you mean by "normal search display."
_raw represents the entire event. It is unusual to use _raw in the table command. Instead, include a list of the fields of interest. I can't tell you what fields that would be, since it depends entirely on your data. But for example:
... | table seq_num _time delta_time host status message