I'm would like to construct a search of our phone logs that provides a report indicating when a person calls someone back shortly after a call ends.
Time_Start, Time_End, Source_Number, Dest_Number
10:10, 10:20, 555-1212,555-1313
10:22, 10:30, 555-1212,555-1313
In the example data above, I'd like to increment a field called "callbacks" for the source field. The criteria for incrementing the callbacks field would be if the source number calls the destination number within 2 minutes of the call ending. If the source number calls a different number, that shouldn't be added to callbacks. I've written a lot of splunk searches, but this is beyond me.. Any guidance would be appreciated.
Can you please try this?
YOUR_SEARCH
| autoregress Time_End as Time_End_pre p=1
| autoregress Source_Number as Source_Number_pre p=1
| autoregress Dest_Number as Dest_Number_pre p=1
| eval duration_Time_End_pre=strptime(Time_End_pre,"%H:%M"),duration_Time_Start=strptime(Time_Start,"%H:%M")
| eval duration = round(duration_Time_Start-duration_Time_End_pre)
| eval callbacks = if(Source_Number=Source_Number_pre AND Dest_Number=Dest_Number_pre AND duration<=120,"True","False")
| table Time_Start, Time_End, Source_Number, Dest_Number duration callbacks
My Sample Search :
| makeresults | eval _raw="Time_Start, Time_End, Source_Number, Dest_Number
10:10, 10:20, 555-1212,555-1313
10:22, 10:30, 555-1212,555-1313" | multikv forceheader=1
| autoregress Time_End as Time_End_pre p=1
| autoregress Source_Number as Source_Number_pre p=1
| autoregress Dest_Number as Dest_Number_pre p=1
| eval duration_Time_End_pre=strptime(Time_End_pre,"%H:%M"),duration_Time_Start=strptime(Time_Start,"%H:%M")
| eval duration = round(duration_Time_Start-duration_Time_End_pre)
| eval callbacks = if(Source_Number=Source_Number_pre AND Dest_Number=Dest_Number_pre AND duration<=120,"True","False")
| table Time_Start, Time_End, Source_Number, Dest_Number duration callbacks
Thanks
KV
▄︻̷̿┻̿═━一
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.