Splunk Search

How to calculate latencies between jobs?

Aqawelska
Observer

Hi ,

I need to find the time difference between two events, these events are when a job on our server starts running and when it finishes.

I found this answer to a very similar question https://community.splunk.com/t5/Splunk-Search/Calculate-time-difference-between-two-events/td-p/5786...

but when i try this it does not show me the latency (empty). , I think it has something to do with the search words or the conditions I'm using but I am not sure. Any help is appreciated !


index="0200-pio_numb3r5_support-app" "HumanResourceImportJob" AND "transitioning from state 'Processing' to 'Succeeded'. Reason:" OR "transitioning from state 'Enqueued' to 'Processing'. Reason:" AND NOT OnStateUnapplied
| where host="AUDIINSA4919" OR host="AUDIINSA4304"
| stats earliest(_time) as Start_time, latest(_time) as Finished_time by host
| eval Latency=tostring(Start_time-Finished_time, "duration")
| table Start_time , Finished_time , Latency , host
| fieldformat Finished_time=strftime(Finished_time,"%c")
| fieldformat Start_time=strftime(Start_time,"%c")


The output is with latency empty:

             Start_time                                       Finished_time                       Latency        host

1 Wed May 18 03:30:08 2022 Wed May 18 03:42:47 2022   AUDIINSA4304



Labels (2)
Tags (1)
0 Karma

gcusello
Legend

Hi @Aqawelska,

you should calculate Finish_time-Start_time not the contrary:

index="0200-pio_numb3r5_support-app" "HumanResourceImportJob" AND "transitioning from state 'Processing' to 'Succeeded'. Reason:" OR "transitioning from state 'Enqueued' to 'Processing'. Reason:" AND NOT OnStateUnapplied
| where host="AUDIINSA4919" OR host="AUDIINSA4304"
| stats 
     earliest(_time) AS Start_time 
     latest(_time) AS Finished_time 
     by host
| eval Latency=tostring(Finished_time-Start_time, "duration")
| table Start_time , Finished_time , Latency , host
| fieldformat Finished_time=strftime(Finished_time,"%c")
| fieldformat Start_time=strftime(Start_time,"%c")

 Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...