How to calculate interval sum for repeated event pairs

[CatherineLiu007]

Hi, I'm a Splunk newbie. Can anyone help me with this. Thanks.

For the following events, I need to calculate the sum of time interval used for stepA to stepB. So it should be (TimeStamp3 - TimeStamp2) + (TimeStamp5 - TimeStamp4) + (TimeStamp7-TimeStamp6).

TimeStamp1 Step=stepStart, Tid=1111
TimeStamp2 Step=stepA, Tid=1111
TimeStamp3 Step=stepB, Tid=1111
TimeStamp4 Step=stepA, Tid=1111
TimeStamp5 Step=stepB, Tid=1111
TimeStamp6 Step=stepA, Tid=1111
TimeStamp7 Step=stepB, Tid=1111
TimeStamp8 Step=stepEnd, Tid=1111

[somesoni2]

Give this a try (change the field name as applicable)

your base search | sort 0 Tid Timestamp | streamstats current=f window=1 first(Timestamp) as prev | eval StepABDuration=if(Step="stepB", Timestamp-prev,0) | stats min(Timestamp) as start max(Timestamp) as max sum(StepABDuration) as StepABDuration by Tid | eval StepDuration=max-min | table Tid, StepDuration, StepABDuration

[CatherineLiu007]

Thanks so much for your help. I'm getting 'Error in 'streamstats' command: The argument ' ' is invalid. Is it because I tried to sum up two different event pairs?

TimeStamp1 Step=stepStart, Tid=1111
TimeStamp2 Step=stepA, Tid=1111
TimeStamp3 Step=stepB, Tid=1111
TimeStamp4 Step=stepC, Tid=1111
TimeStamp5 Step=stepD, Tid=1111
TimeStamp6 Step=stepA, Tid=1111
TimeStamp7 Step=stepB, Tid=1111
TimeStamp9 Step=stepA, Tid=1111
TimeStamp10 Step=stepB, Tid=1111
TimeStamp11 Step=stepC, Tid=1111
TimeStamp12 Step=stepD, Tid=1111
TimeStamp13 Step=stepEnd, Tid=1111

| eval TotalTime = duration
| sort 0 TimeStamp

| streamstats current=f window=1 first(TimeStamp) as prev 
| eval stepABDuration=if(Step="stepB", Timestamp-prev,0) 
| eval stepCDDuration=if(Step="stepD", TimeStamp-prev,0) 

| stats sum(stepABDuration) as stepABDuration by Tid 
| stats sum(stepCDDuration) as stepCDDuration by Tid 

| transaction TId 

| table Tid, TotalTime, stepABDuration, stepCDDuration

[somesoni2]

Will there be any other steps in between stepA and stepB?

[CatherineLiu007]

There will not be any other steps between stepA and stepB. But there may be other steps between stepStart and stepEnd. Thanks.

[somesoni2]

Ok. One last thing, what would be the final output? mention all the fields that you want.

[CatherineLiu007]

Final output will include Tid, duration for stepStart to stepEnd, sum of all stepA to stepB. Thanks.