Splunk Search

How do I report on timestamps for earliest and latest field values for multiple events in a search?

New Member

I have a list of logs that are relevant to a specific sourcetype and serial Number. My search results in the following types of logs which have mutiple phase values. My logs look like the following and naturally show up in chronological order (latest first) from the search query:

Search: sourcetype="loglist" serialnum="n1234" segmentid="15"

...serialnum="n1234"..."segmentid=15", host="abcd", phase="precall",
...serialnum="n1234"..."segmentid=15", host="abcd", phase="callexcept",
...serialnum="n1234"..."segmentid=15", host="abcd", phase="precall",
...serialnum="n1234"..."segmentid=15", host="abcd", phase="callresult",
...serialnum="n1234"..."segmentid=15", host="abcd", phase="precall",

I'm interested in getting (1) the timestamps and (2) the duration for the earliest or latest combination of precall and callresult logs. i.e., the time difference between the earliest log with phase="precall" and earliest log with phase="callresult". I would like to be able to (2) repeat this with the latest combinations and (2) scale this query to all serialnumbers and their corresponding segmentids within the sourcetype.

I tried this:
sourcetype="loglist" serialnum="N1234" segmentid="15"| stats earliest(eval(phase="precall")) as d1 earliest(eval(phase="callresult")) as d2| eval k1=d1 | eval k2=d2| transaction startswith(k1) endswith (k2) | table duration

Splunk identifies the events, but it's unable to perform any calculations on it. I'm basically trying to assign the earliest precall and callresult logs to a new field so that I can calculate duration based of that. Any thoughts on how I can modify this search would help! Thanks!

Tags (2)
0 Karma

Esteemed Legend

This should work:

sourcetype="loglist" | stats earliest(eval(phase="precall")) as d1 earliest(eval(phase="callresult")) as d2 by serialnum,segmentid | eval duration=d2-d1
0 Karma

Splunk Employee
Splunk Employee

Right now, you're using stats which gathers everything up into buckets as designated. What it sounds like you are looking for is THE earliest as a single value and then do something with that value... so you want streamstats. it uses the same functions.

If that doesn't do it for you or at least make sense... you might want to explain the statement "unable to perform any calculations on it". Like what?

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!