Splunk Search

How do you calculate time difference between multiple events that aren't in chronological order?

puneetkharband1
Path Finder

I have 6 events. Each one has a timestamp, and I have extracted the time of each into a new field using eval. But now, I am not able to create timedifference between event6-event1 or event4-event3 as per my needs.

I do not want to use the transaction command as I need to write multiple searches, and I am trying to solve this in search.

I am at a point where my last seach line is

| table Fourm_step_1_Time Fourm_step_2_Time Fourm_step_3_Time Fourm_step_4_Time Fourm_step_5_Time Fourm_step_6_Time

results are
0 0
0 0
0 0
0 0
0 123435453
1234545433 0
so on
@somesoni2

0 Karma

ehollima
Path Finder

When I am looking for time skews I use the following (credit to Hunter for the SPL)

index= earliest=-1m latest=+24h
| stats latest(_time) AS time by host
| eval now=now()
| eval offset=time-now
| eval time1=strftime(time,"%F - %T")
| eval now1=strftime(now,"%F - %T %Z")
| eval offset1=tostring(offset,"duration")
| convert ctime(time), ctime(now)
| table host offset offset1 time now now1 time1

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...