Splunk Search

Grouping a "time" span from one true value to another

krwinters11
Path Finder

I have a boolean value in my data set. I want to group all event together that are between the event(a) right after a boolean value goes true all the way through to the next event(b) with a true value. So then the next grouping would start at the next event(c) (directly after the event(b)) and include every event through to the next event(d) with a true value, and so on.

My difficulties are coming from the fact that is is not actually based on a time field and the time between true events, constantly changes. Is it possible for this to be calculated on the fly, while doing a search. In the end, I would like to look at several of these groups to then use the predict command.

If I am not clear, please ask me to elaborate further. The question probably seems clearer in my head...

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Sounds like what you want is the transaction command, with the startswith= set to detect your boolean true.

You could also do something like ...

| makeresults  | eval mybool="T F F F T F T F T T F F F F T F" | makemv mybool | mvexpand mybool 
| streamstats count as recno | eval _time = relative_time(now(),"-1h@h") + 60*recno
| rename COMMENT as "The above just generates some events with mybool=T or mybool=F."

| streamstats count(eval(mybool="T")) as setno 

Each record will then have a value for setno based on the last event that mybool was true.

0 Karma

kenvanderheyden
Path Finder

Hello,

If I understand correctly you want to calculate the time between the "true" events based on another field than the _time ?

You can do this, using the delta between the "true" events as follows:

| eval tDT= strptime(Your_Date_Field, "%F")
| delta tDT as t_diff
| eval t_diff = floor(t_diff / 86400)
| eval _time = strptime(Your_Date_Field, "%F")
| timechart span=7d values(t_diff) as values

This calculates the time between events in days, and displays the results in a timechart with span of 1 week (7 days).
Hope this helps.

Regards,
Ken.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...