Splunk Search

How to Calculate time difference with _metrics events?

jordanking1992
Path Finder

We recently started working with metrics data. The application is sending metrics events with the dimensions:

component, deployment_id, timestamp_seconds_from_epoch

and metrics names: change_committed, release

We are trying to calculate the duration between deployment_id's from the time a change was committed (change_committed) and released (release) based on timestamp_seconds_from_epoch (which is a timestamp in epoch time)

We thought the transaction command would be helpful but since we arent leverage _time and instead using a custom time field called timestamp_in_epoch_time, we are having some trouble figuring out the best approach.

Here is what we currently have:

| mstats avg("change_committed") as change_committed prestats-true WHERE "index"="statsd" span=auto BY deployment_id | table _time deployment_id | append [ | mstats avg("release") as release prestats-true WHERE "index"="statsd" span=auto BY deployment_id | table _time deployment_id

Example metrics events:

change_committed:1,timestamp_seconds_from_epoch:1651096172,deployment_id:28020

release:1,timestamp_seconds_from_epoch:1651097000,deployment_id:28020

How can we track the duration of timestamp_seconds_from_epoch between a change_committed and release event for each deployment_id?

Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...