Splunk Search

Durations for Individual Events after grouping them together

cmerriman
Super Champion

I have strings of individual events that can be grouped together by a person's unique ID. What I need to figure out is how to get the duration of each of those events by each person and each screen they view, since it doesn't come back in the data. Here is my query so far:

sourcetype=mysource |sort _time (a)|stats list(_time) as Time list(ScreenId) as ScreenName by uniqueId

What comes back:

uniqueId    Time        ScreenName
 12345      1400054039      Screen1
            1400054065      Screen2
            1400054076

My next step would be to figure out how to add a field (duration) making Screen1 being 26 seconds and Screen 2 being 11 seconds. Screen1 is calculated from the duration on Screen2-duration on Screen1 and Screen2 is calculated based on the Null line (140054076)-duration on Screen2.

Any ideas?

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this

sourcetype=mysource | sort -_time | streamstats current=f window=1 first(_time) as prevTime by uniqueId | eval duration=tostring(prevTime-_time, "duration") | stats list(_time) as Time list(ScreenId) as ScreenName list(duration) as Duration by uniqueId

View solution in original post

somesoni2
Revered Legend

Try this

sourcetype=mysource | sort -_time | streamstats current=f window=1 first(_time) as prevTime by uniqueId | eval duration=tostring(prevTime-_time, "duration") | stats list(_time) as Time list(ScreenId) as ScreenName list(duration) as Duration by uniqueId

cmerriman
Super Champion

That is PERFECT!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...