Splunk Search

Find Time between events, including current Time.

jrnastase
Explorer

Hello all,

I've seen examples of how to find time between events using streamstats, and also to find the time since the most recent event using stats, but how would I accomplish doing both?

Ultimately I'm trying to detect a loss of information that's reported every 10 minutes, so I'm using streamstats to search for differences of > 10 min, however this "outage" isn't detected until after the data is reported again, thus giving streamstats two items to actually compare. I need all of these deltas, and also the time since the most recent as occurred.

Thanks, and here's some code I have:

search

| streamstats current=t last(_time) as last_time by field 
| eval outage= last_time - _time
| eval outage=tostring(outage, "duration")
| table field _time outage
0 Karma

somesoni2
Revered Legend

Give this a try

search
| streamstats window=1 current=f values(_time) as last_time by field 
| eval last_time=if(isnull(last_time),now(),last_time)
| eval outage= abs(last_time - _time)
| where outage>600
| eval outage=tostring(outage, "duration")
| table field _time outage
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...