Splunk Search

## Duration between events

Splunk Employee

Given transit data like:

``````2019-03-19 19:00:32 GMT vehicle_id="58" stop_direction=Inbound
2019-03-19 19:05:45 GMT vehicle_id="57" stop_direction=Outbound
2019-03-19 19:10:45 GMT vehicle_id="59" stop_direction=Outbound
2019-03-19 19:21:32 GMT vehicle_id="58" stop_direction=Inbound
2019-03-19 19:25:06 GMT vehicle_id="57" stop_direction=Outbound
2019-03-19 19:37:43 GMT vehicle_id="58" stop_direction=Outbound
2019-03-19 19:41:02 GMT vehicle_id="59" stop_direction=Inbound
``````

A "trip" is starting at one end of the line and going to the other end. I want to calculate the duration of every trip. You know when a trip ends because the a particular vehicle's `stop_direction` changes either from "Inbound" to "Outbound" or vice versa.

For example, when vehicle 58 changes from "Inbound" (line 4) to "Outbound" (line 6), then it had a "trip" starting from the oldest contiguous "Inbound" (line 1) to the last "Inbound" (line 4) before changing to "Outbound" (line 6). Hence, the duration would conceptually be time_of_event(4) - time_of_event(1).

Explained another way: for a given vehicle, if you were to plot its stop direction (where `I` is "Inbound" and `O` is "Outbound"), then:

``````IIII OOOOO III OOO IIIIIIII
^^^^ ^^^^^ ^^^ ^^^ ^^^^^^^^
T1   T2    T3  T4  T5
``````

I.e., a run of the same stop direction constitutes a "trip." When the direction changes, it's the next trip.

I want to calculate the duration of every trip and chart it such that the X-axis is the trip and the Y-axis is the duration of that trip.

Tags (2)
Ultra Champion

https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Transaction

``````..your search..|transaction vehicle_id startswith=Outbound endswith=Inbound|transaction vehicle_id startswith=Inbound endswith=Outbound|eval stops=eventcount, duration=round(duration/1000,0)|table vehicle_id stops duration
``````

Duration will be in seconds

If my comment helps, please give it a thumbs up!
Splunk Employee

Shouldn't that be: `duration=duration/60`?

I think my search should be: `my_search | streamstats window=2 global=f earliest(_time) as start latest(_time) as end earliest(stop_direction) as dir1 latest(stop_direction) as dir2 by vehicle_id | transaction vehicle_id endswith=eval(dir1!=dir2) | eval duration=duration/60`.

But I want to chart the "trip" (or the "transaction ID") by the duration. For each transaction, I'd need a monotonically increasing integer. How can I get that?

Get Updates on the Splunk Community!

#### Optimize Cloud Monitoring

TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

#### What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

#### Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...