Splunk Search

How to calculate the average delta between each event and the event count?

Path Finder

Hi Splunkers,

Need a help in forming a splunk query.

Requirement: Find the time difference (delta1, delta2,delta3.......) between events by specific field.

Example:

``````User A  eventcount =5 [delta1, delta2, delta3, delta4,]

User B eventcount= 3 [delta1, delta2]
``````

Thanks for the help.

Regards,
Ankith

Tags (3)
1 Solution
Path Finder

Hello,

Formed two queries which serves the purpose which are given below.

|eval abc= _time |bucket span=5m _time | stats values(abc) as time by _time fieldA
| eval a1=mvindex(time, 0), a2=mvindex(time, 1) , a3=mvindex(time, 2) , a4=mvindex(time, 3) , a5=mvindex(time, 4), a6=mvindex(time, 5)
| eval delta1=a2-a1,delta2=a3-a2,delta3=a4-a3,delta4=a5-a4,delta5=a6-a5
| WHERE delta1< 30 OR delta2 < 30 OR delta3 < 30 OR delta4 < 30 OR delta5 < 30
| fields _time fieldA delta1 delta2 delta3 delta4 delta5

This can be used to calculate the delta for 5 events in the span of 5 minutes.

OR

| transaction maxspan=5m fieldA | WHERE eventcount > 3 |eval delta= duration/eventcount | WHERE delta < 30 | table fieldA delta eventcount

This can be used to calculate the average delta between each event and the event count.

Path Finder

Hello,

Formed two queries which serves the purpose which are given below.

|eval abc= _time |bucket span=5m _time | stats values(abc) as time by _time fieldA
| eval a1=mvindex(time, 0), a2=mvindex(time, 1) , a3=mvindex(time, 2) , a4=mvindex(time, 3) , a5=mvindex(time, 4), a6=mvindex(time, 5)
| eval delta1=a2-a1,delta2=a3-a2,delta3=a4-a3,delta4=a5-a4,delta5=a6-a5
| WHERE delta1< 30 OR delta2 < 30 OR delta3 < 30 OR delta4 < 30 OR delta5 < 30
| fields _time fieldA delta1 delta2 delta3 delta4 delta5

This can be used to calculate the delta for 5 events in the span of 5 minutes.