Splunk Search

For all occurences, get the duration of a value dropping below a threshhold

Contributor

I have events that show signal strength. What I want to do is determine the starttime, endtime and duration of any period where the signal strength drops below what is considered 'normal'. My events have two different signals: signalid=1 and signalid=2.

Example event:
time, signalid, signalstrength, normalsignal
2017-05-16 16:17:28, 1,17.38,14.28

Output I'd like to see:
starttime,endtime,duration,signal_id

0 Karma
1 Solution

Esteemed Legend

Like this:

Your Base Search Here
| streamstats count(eval(signal_strength>=normal_signal)) AS sessionID BY signal_id
| stats min(_time) AS start_time max(_time) AS end_time range(_time) AS duration count AS numEvents BY signal_id sessionID
| search numEvents>1

View solution in original post

0 Karma

Esteemed Legend

Like this:

Your Base Search Here
| streamstats count(eval(signal_strength>=normal_signal)) AS sessionID BY signal_id
| stats min(_time) AS start_time max(_time) AS end_time range(_time) AS duration count AS numEvents BY signal_id sessionID
| search numEvents>1

View solution in original post

0 Karma

Contributor

Yes thank you much.

0 Karma