Splunk Search

## How can I calculate the timediff based on non-sequential sequence IDs?

Explorer

I have a requirement wherein I have to find timedifference of 2 events. Below is an example on the event type:

``````Host    Time          SeqID      Transaction
a          1:00:00      5               Start
b          1:30:00      7               Start
a          1:45:00      9               Complete
b          2:00:00      14             Complete
a          4:00:00      19             Start
c           4:30:00      23             Start
a          4:45:00       25            Complete
``````

I need to calculate the timedifferences between 'Start' and 'Complete' for every Host using their SeqID.
To translate roughly, its like
concat(hostname,Time@Complete,SeqId@Complete) - concat(hostname,Time@Start,SeqID@Start)
But in the above calculation, i need to ensure the SeqID@Complete is the most numerically nearest one to the SeqID@Start.

Any thoughts / suggestions?

Tags (3)
1 Solution
SplunkTrust

Hi @khavildar,

Try this

``````index="your index"  "your other search terms"|table _time,host,SeqID ,Transaction|sort host,SeqID |streamstats current=f last(_time) as prev by host|eval time_diff=_time-prev|where Transaction="Complete"|table host,SeqID ,time_diff
``````
Happy Splunking!
SplunkTrust

Hi @khavildar,

Try this

``````index="your index"  "your other search terms"|table _time,host,SeqID ,Transaction|sort host,SeqID |streamstats current=f last(_time) as prev by host|eval time_diff=_time-prev|where Transaction="Complete"|table host,SeqID ,time_diff
``````
Happy Splunking!
Explorer

Works like a charm! Perfect.
Thanks so much!

Get Updates on the Splunk Community!

#### Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

#### Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

#### Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...