Splunk Search

For all occurences, get the duration of a value dropping below a threshhold

jpass
Contributor

I have events that show signal strength. What I want to do is determine the start_time, end_time and duration of any period where the signal strength drops below what is considered 'normal'. My events have two different signals: signal_id=1 and signal_id=2.

Example event:
_time, signal_id, signal_strength, normal_signal
2017-05-16 16:17:28, 1,17.38,14.28

Output I'd like to see:
start_time,end_time,duration,signal_id

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

Your Base Search Here
| streamstats count(eval(signal_strength>=normal_signal)) AS sessionID BY signal_id
| stats min(_time) AS start_time max(_time) AS end_time range(_time) AS duration count AS numEvents BY signal_id sessionID
| search numEvents>1

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

Your Base Search Here
| streamstats count(eval(signal_strength>=normal_signal)) AS sessionID BY signal_id
| stats min(_time) AS start_time max(_time) AS end_time range(_time) AS duration count AS numEvents BY signal_id sessionID
| search numEvents>1

View solution in original post

0 Karma

jpass
Contributor

Yes thank you much.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!