Splunk Search

Finding time difference between 2 events with different states

KaitoKozo
Explorer

I am trying to find the time difference between 2 events with different states, in particular when the device turns on or off. However, I only have the field of status which shows that it's on (1) or off (0).

I made use of the delta function to derive whether the device is turning on (1), turning off (-1) or no change in state (0) as state as follows:
| delta status p=1 as switch_state

I would like to know the operation hours of the device (time difference between switch_state=-1 and switch_state=1) but am unsure how to do a comparison. 

My previous attempt was to use the streamstats function to compute, however I could only compare between same states as follows:

| streamstats count(eval(switch_state=-1)  AS startcount by asset
| stats range(_time)  AS duration by startcount asset

Hoping to try to change the code or use a different method to compare between states -1 and 1 within the same field and then find the time difference between them.

Labels (1)
0 Karma

tscroggins
Influencer

@KaitoKozo 

In simple scenarios with a relatively small number of events, the transaction command works well enough:

| transaction asset startswith=eval(switch_state==1) endswith=eval(switch_state==-1)
| table _time asset duration
| fieldformat duration=tostring(duration, "duration")

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...