Splunk Search

How to Calculate time difference with _metrics events?

jordanking1992
Path Finder

We recently started working with metrics data. The application is sending metrics events with the dimensions:

component, deployment_id, timestamp_seconds_from_epoch

and metrics names: change_committed, release

We are trying to calculate the duration between deployment_id's from the time a change was committed (change_committed) and released (release) based on timestamp_seconds_from_epoch (which is a timestamp in epoch time)

We thought the transaction command would be helpful but since we arent leverage _time and instead using a custom time field called timestamp_in_epoch_time, we are having some trouble figuring out the best approach.

Here is what we currently have:

| mstats avg("change_committed") as change_committed prestats-true WHERE "index"="statsd" span=auto BY deployment_id | table _time deployment_id | append [ | mstats avg("release") as release prestats-true WHERE "index"="statsd" span=auto BY deployment_id | table _time deployment_id

Example metrics events:

change_committed:1,timestamp_seconds_from_epoch:1651096172,deployment_id:28020

release:1,timestamp_seconds_from_epoch:1651097000,deployment_id:28020

How can we track the duration of timestamp_seconds_from_epoch between a change_committed and release event for each deployment_id?

Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...