Splunk Search

Finding time difference between 2 events with different states

KaitoKozo
Explorer

I am trying to find the time difference between 2 events with different states, in particular when the device turns on or off. However, I only have the field of status which shows that it's on (1) or off (0).

I made use of the delta function to derive whether the device is turning on (1), turning off (-1) or no change in state (0) as state as follows:
| delta status p=1 as switch_state

I would like to know the operation hours of the device (time difference between switch_state=-1 and switch_state=1) but am unsure how to do a comparison. 

My previous attempt was to use the streamstats function to compute, however I could only compare between same states as follows:

| streamstats count(eval(switch_state=-1)  AS startcount by asset
| stats range(_time)  AS duration by startcount asset

Hoping to try to change the code or use a different method to compare between states -1 and 1 within the same field and then find the time difference between them.

Labels (1)
0 Karma

tscroggins
Influencer

@KaitoKozo 

In simple scenarios with a relatively small number of events, the transaction command works well enough:

| transaction asset startswith=eval(switch_state==1) endswith=eval(switch_state==-1)
| table _time asset duration
| fieldformat duration=tostring(duration, "duration")

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...