How to calculate the durations between 1 start event and multiple end events?

[collier31200]

Hello all,

How do I get the time between one start event and multiple end events?

Let me explain:
I have one start event and multiple end events and I need to see the duration between the start event and each of the end events.
Currently I'm using the following search, but only raised the duration between the start event and the first end event.
This search correctly displays all the other occurrences of end events, but without the durations 😞

my search | transaction startswith="Status update" endswith="Mount"  keepevicted=t  | sort 0 _time | table _time Update Mounted duration _raw

Please helppp !! 🙂

[woodcock]

Assuming your transaction has another correlation field (e.g. a mountpoint/directory-name) which you did not specify (a big "if", I know), you can do it like this:

... | eventstats earliest(_time) AS StartTime by correlationID | search "Mount" | eval duration=_time-StartTime | table _time Update Mounted duration _raw

[collier31200]

My transaction has not another correlation field :S..
But thank you, this search will help for other stuff 😄

[acharlieh · Accepted solution]

What about something like this instead:

... | eval start_time=if(searchmatch("Status update"),_time,null()) | streamstats last(start_time) as last_start_time | eval duration=_time-last_start_time | search "Mount"

1) We create a field start_time which if we have a start event (check out Eval Functions ), we set to the _time of the event, otherwise we don't set it at all.
2) We then use streamstats to get the most recent start time for each event
3) We then keep only the ending events

[collier31200]

Work perfectly, thank you 🙂