Find Time-Range for Most Recent event.

[njwrk]

So I have splunk events and I want to display information as a time range. For example:
event type1: Started proc1 id=123
event type2: Stoped proc1 id=123
(Assume id 123 is associated with proc1)
So I want to display the time duration for which proc1 ran most recently. I have following splunk query:
index | search "started" OR "Stopped" | where id=123 | sort - _time | head 2

This gives me the 2 events which I'am interested in. But how can I extract the _time from both events?

[woodcock]

Like this:

index=YourIndexHere sourcetype=YourSourcetypeHere started OR stopped | stats range(_time) AS duration BY id

[niketn]

You can easily create a transaction with id as if transaction id and startswith and endswith criteria as *Started* and *Stopped* respectively. Transaction command automatically generates the correlated eventcount and duration between the events. However, stats will be faster and better alternative in this scenario. Please give following a try:

index=<YourIndexName> "Started" OR "Stopped" id=*
| eval Status=if(searchmatch("Started"),"Started","Stopped")
| stats count as eventcount values(Status) as Status min(_time) as MinTime max(_time) as MaxTime by id
| search eventcount>1 Status="Started" Statsus="Stopped"
| eval duration=MaxTime-MinTime
| eval _time=MinTime
| fieldformat MinTime=strftime(MinTIme,"%c")
| fieldformat MaxTime=strftime(MaxTIme,"%c")
| table _time Status id duration MinTime MaxTime

If you want to find transactions which have started but not stopped you can change the search criteria accordingly.

[niketn]

@njwrk Please accept the answer if this has helped.