Splunk Search

Eval total duration in minutes

lavster
Path Finder

i've created a table from a project run that displays the time a run started, ended and what time files have been created during the run.

However Im trying to do an eval to get the Total Duration in Minutes for each service which is

Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi lavster,
I suggest to use a different approach to this kind of searches:

  • at first stop to think to Splunk as a database!
  • then don't use join because it's a very slow command!
  • in addition, remember that there's the limit of 50,000 results for subsearches, so you cannot be sure to have all the results in subsearches used in joins;
  • don't use fields with spaces (e.g. "ESLA File Start"), if you want, you can rename fields at the end of the search

So you should try to build something like this one:

index=esla OR index=mule-new (State=START OR State=END) Service="Early SLA"
| bucket _time span=1d as Day 
| eval "ESLA File Start"=if(State="START",FileTime,""),"ESLA File End"=if(State="END",FileTime,""), Day=strftime(Day,"%d/%m/%Y")
| stats earliest(_time) as ESLA_Start latest(_time) as ESLA_End values( "ESLA File Start") AS  "ESLA File Start" values( "ESLA File End") AS  "ESLA File End" by Day
| eval st=strptime(ESLA_Start,"%H:%M:%S"), et=strptime("ESLA File End","%H:%M:%S"), diff=et-st, "ESLA_Total" = tostring(diff, "duration")
| table Day ESLA_Start ESLA_End "ESLA File Start" "ESLA File End" "ESLA_Total"

I cannot test it but the approach should be correct.

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi lavster,
I suggest to use a different approach to this kind of searches:

  • at first stop to think to Splunk as a database!
  • then don't use join because it's a very slow command!
  • in addition, remember that there's the limit of 50,000 results for subsearches, so you cannot be sure to have all the results in subsearches used in joins;
  • don't use fields with spaces (e.g. "ESLA File Start"), if you want, you can rename fields at the end of the search

So you should try to build something like this one:

index=esla OR index=mule-new (State=START OR State=END) Service="Early SLA"
| bucket _time span=1d as Day 
| eval "ESLA File Start"=if(State="START",FileTime,""),"ESLA File End"=if(State="END",FileTime,""), Day=strftime(Day,"%d/%m/%Y")
| stats earliest(_time) as ESLA_Start latest(_time) as ESLA_End values( "ESLA File Start") AS  "ESLA File Start" values( "ESLA File End") AS  "ESLA File End" by Day
| eval st=strptime(ESLA_Start,"%H:%M:%S"), et=strptime("ESLA File End","%H:%M:%S"), diff=et-st, "ESLA_Total" = tostring(diff, "duration")
| table Day ESLA_Start ESLA_End "ESLA File Start" "ESLA File End" "ESLA_Total"

I cannot test it but the approach should be correct.

Bye.
Giuseppe

0 Karma

lavster
Path Finder

Thank you, i'll give this a go.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...