Splunk Search

## Durations for Individual Events after grouping them together

Super Champion

I have strings of individual events that can be grouped together by a person's unique ID. What I need to figure out is how to get the duration of each of those events by each person and each screen they view, since it doesn't come back in the data. Here is my query so far:

sourcetype=mysource |sort _time (a)|stats list(_time) as Time list(ScreenId) as ScreenName by uniqueId

What comes back:

``````uniqueId    Time        ScreenName
12345      1400054039      Screen1
1400054065      Screen2
1400054076
``````

My next step would be to figure out how to add a field (duration) making Screen1 being 26 seconds and Screen 2 being 11 seconds. Screen1 is calculated from the duration on Screen2-duration on Screen1 and Screen2 is calculated based on the Null line (140054076)-duration on Screen2.

Any ideas?

Tags (1)
1 Solution
SplunkTrust

Try this

``````sourcetype=mysource | sort -_time | streamstats current=f window=1 first(_time) as prevTime by uniqueId | eval duration=tostring(prevTime-_time, "duration") | stats list(_time) as Time list(ScreenId) as ScreenName list(duration) as Duration by uniqueId
``````
SplunkTrust

Try this

``````sourcetype=mysource | sort -_time | streamstats current=f window=1 first(_time) as prevTime by uniqueId | eval duration=tostring(prevTime-_time, "duration") | stats list(_time) as Time list(ScreenId) as ScreenName list(duration) as Duration by uniqueId
``````
Super Champion

That is PERFECT!

Get Updates on the Splunk Community!

#### Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

#### Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

#### .conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...