Splunk Search

How to calculate the durations between 1 start event and multiple end events?

collier31200
Explorer

Hello all,

How do I get the time between one start event and multiple end events?

Let me explain:
I have one start event and multiple end events and I need to see the duration between the start event and each of the end events.
Currently I'm using the following search, but only raised the duration between the start event and the first end event.
This search correctly displays all the other occurrences of end events, but without the durations 😞

my search | transaction startswith="Status update" endswith="Mount"  keepevicted=t  | sort 0 _time | table _time Update Mounted duration _raw

Please helppp !! 🙂

1 Solution

acharlieh
Influencer

What about something like this instead:

... | eval start_time=if(searchmatch("Status update"),_time,null()) | streamstats last(start_time) as last_start_time | eval duration=_time-last_start_time | search "Mount"

1) We create a field start_time which if we have a start event (check out Eval Functions ), we set to the _time of the event, otherwise we don't set it at all.
2) We then use streamstats to get the most recent start time for each event
3) We then keep only the ending events

View solution in original post

woodcock
Esteemed Legend

Assuming your transaction has another correlation field (e.g. a mountpoint/directory-name) which you did not specify (a big "if", I know), you can do it like this:

... | eventstats earliest(_time) AS StartTime by correlationID | search "Mount" | eval duration=_time-StartTime | table _time Update Mounted duration _raw
0 Karma

collier31200
Explorer

My transaction has not another correlation field :S..
But thank you, this search will help for other stuff 😄

0 Karma

acharlieh
Influencer

What about something like this instead:

... | eval start_time=if(searchmatch("Status update"),_time,null()) | streamstats last(start_time) as last_start_time | eval duration=_time-last_start_time | search "Mount"

1) We create a field start_time which if we have a start event (check out Eval Functions ), we set to the _time of the event, otherwise we don't set it at all.
2) We then use streamstats to get the most recent start time for each event
3) We then keep only the ending events

collier31200
Explorer

Work perfectly, thank you 🙂

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...