Splunk Search

For all occurences, get the duration of a value dropping below a threshhold

jpass
Contributor

I have events that show signal strength. What I want to do is determine the start_time, end_time and duration of any period where the signal strength drops below what is considered 'normal'. My events have two different signals: signal_id=1 and signal_id=2.

Example event:
_time, signal_id, signal_strength, normal_signal
2017-05-16 16:17:28, 1,17.38,14.28

Output I'd like to see:
start_time,end_time,duration,signal_id

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

Your Base Search Here
| streamstats count(eval(signal_strength>=normal_signal)) AS sessionID BY signal_id
| stats min(_time) AS start_time max(_time) AS end_time range(_time) AS duration count AS numEvents BY signal_id sessionID
| search numEvents>1

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

Your Base Search Here
| streamstats count(eval(signal_strength>=normal_signal)) AS sessionID BY signal_id
| stats min(_time) AS start_time max(_time) AS end_time range(_time) AS duration count AS numEvents BY signal_id sessionID
| search numEvents>1
0 Karma

jpass
Contributor

Yes thank you much.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...