Splunk Search

Display result when comparing 3 fields, only show greater by 100 for one field

baustin612
Explorer

I have a search that is giving me this data set:

ID             status       Stamp
alex         esb            1595989827764
alex         fuz             1595989827762
jake         esb            1596056447122
jake         fuz             1596056447085
josh         esb            1596054751935
josh         fuz             1596054751852
stefan    esb             1596056406846
stefan    fuz              1596056406806

I want to compare the Stamp by ID, and show any ID's where the stamp for esb is great than the stampe for fuz by at least 100. Any help appreciated.

Labels (4)
0 Karma
1 Solution

soutamo
SplunkTrust
SplunkTrust

Hi

Your Stamps haven't any greater than 100 so I use greater than 50.

index=_internal | head 1
| eval _raw="ID,             status,       Stamp
alex,esb,1595989827764
alex,fuz,1595989827762
jake,esb,1596056447122
jake,fuz,1596056447085
josh,fuz,1596054751852
josh,esb,1596054751935
stefan,esb,1596056406846
stefan,fuz,1596056406806" 
| multikv forceheader=1
| eval stamp=tonumber(trim(stamp))
| rename COMMENT as "previous prepare sample data"
| eval esb_stamp = if(status == "esb", Stamp, null())
| eventstats range(Stamp) as duration values(esb_stamp) as esb_stamp by ID
| table duration ID status Stamp esb_stamp
| where esb_stamp >= 50 + Stamp

r. Ismo 

View solution in original post

to4kawa
SplunkTrust
SplunkTrust

|stats range(Stamp) as duration by ID

|where duration > 100

baustin612
Explorer

Thank you for the quick reply!

How does this take into account status? I only want to display those where 'esb' timestamp is >= 'fuz' timestamp +100.

0 Karma

soutamo
SplunkTrust
SplunkTrust

Hi

Your Stamps haven't any greater than 100 so I use greater than 50.

index=_internal | head 1
| eval _raw="ID,             status,       Stamp
alex,esb,1595989827764
alex,fuz,1595989827762
jake,esb,1596056447122
jake,fuz,1596056447085
josh,fuz,1596054751852
josh,esb,1596054751935
stefan,esb,1596056406846
stefan,fuz,1596056406806" 
| multikv forceheader=1
| eval stamp=tonumber(trim(stamp))
| rename COMMENT as "previous prepare sample data"
| eval esb_stamp = if(status == "esb", Stamp, null())
| eventstats range(Stamp) as duration values(esb_stamp) as esb_stamp by ID
| table duration ID status Stamp esb_stamp
| where esb_stamp >= 50 + Stamp

r. Ismo 

View solution in original post

baustin612
Explorer

Thank you very much! 

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!