So I have splunk events and I want to display information as a time range. For example:
event type1: Started proc1 id=123
event type2: Stoped proc1 id=123
(Assume id 123 is associated with proc1)
So I want to display the time duration for which proc1 ran most recently. I have following splunk query:
index | search "started" OR "Stopped" | where id=123 | sort - _time | head 2
This gives me the 2 events which I'am interested in. But how can I extract the _time from both events?
You can easily create a transaction with id as if transaction id and startswith and endswith criteria as *Started* and *Stopped* respectively. Transaction command automatically generates the correlated eventcount and duration between the events. However, stats will be faster and better alternative in this scenario. Please give following a try:
index=<YourIndexName> "Started" OR "Stopped" id=* | eval Status=if(searchmatch("Started"),"Started","Stopped") | stats count as eventcount values(Status) as Status min(_time) as MinTime max(_time) as MaxTime by id | search eventcount>1 Status="Started" Statsus="Stopped" | eval duration=MaxTime-MinTime | eval _time=MinTime | fieldformat MinTime=strftime(MinTIme,"%c") | fieldformat MaxTime=strftime(MaxTIme,"%c") | table _time Status id duration MinTime MaxTime
If you want to find transactions which have started but not stopped you can change the search criteria accordingly.