Splunk Search

Finding time difference between 2 events with different states

KaitoKozo
Explorer

I am trying to find the time difference between 2 events with different states, in particular when the device turns on or off. However, I only have the field of status which shows that it's on (1) or off (0).

I made use of the delta function to derive whether the device is turning on (1), turning off (-1) or no change in state (0) as state as follows:
| delta status p=1 as switch_state

I would like to know the operation hours of the device (time difference between switch_state=-1 and switch_state=1) but am unsure how to do a comparison. 

My previous attempt was to use the streamstats function to compute, however I could only compare between same states as follows:

| streamstats count(eval(switch_state=-1)  AS startcount by asset
| stats range(_time)  AS duration by startcount asset

Hoping to try to change the code or use a different method to compare between states -1 and 1 within the same field and then find the time difference between them.

Labels (1)
0 Karma

tscroggins
Influencer

@KaitoKozo 

In simple scenarios with a relatively small number of events, the transaction command works well enough:

| transaction asset startswith=eval(switch_state==1) endswith=eval(switch_state==-1)
| table _time asset duration
| fieldformat duration=tostring(duration, "duration")

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...