Splunk Search

Finding time difference between 2 events with different states

KaitoKozo
Explorer

I am trying to find the time difference between 2 events with different states, in particular when the device turns on or off. However, I only have the field of status which shows that it's on (1) or off (0).

I made use of the delta function to derive whether the device is turning on (1), turning off (-1) or no change in state (0) as state as follows:
| delta status p=1 as switch_state

I would like to know the operation hours of the device (time difference between switch_state=-1 and switch_state=1) but am unsure how to do a comparison. 

My previous attempt was to use the streamstats function to compute, however I could only compare between same states as follows:

| streamstats count(eval(switch_state=-1)  AS startcount by asset
| stats range(_time)  AS duration by startcount asset

Hoping to try to change the code or use a different method to compare between states -1 and 1 within the same field and then find the time difference between them.

Labels (1)
0 Karma

tscroggins
SplunkTrust
SplunkTrust

@KaitoKozo 

In simple scenarios with a relatively small number of events, the transaction command works well enough:

| transaction asset startswith=eval(switch_state==1) endswith=eval(switch_state==-1)
| table _time asset duration
| fieldformat duration=tostring(duration, "duration")

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Cisco Data Fabric from Architecture to Investigation, Better SOC Visibility, and More ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

The Trust Gap: Why a Data Foundation is Fundamental to an Agentic Enterprise

The Trust Gap: Why a data foundation is fundamental to an  Agentic Enterprise.   Agentic AI is transforming ...

Data Management Digest – September 2026

    Welcome to the September 2026 edition of Data Management Digest! September brought a fresh wave of ...