Hello all,
How do I get the time between one start event and multiple end events?
Let me explain:
I have one start event and multiple end events and I need to see the duration between the start event and each of the end events.
Currently I'm using the following search, but only raised the duration between the start event and the first end event.
This search correctly displays all the other occurrences of end events, but without the durations 😞
my search | transaction startswith="Status update" endswith="Mount" keepevicted=t | sort 0 _time | table _time Update Mounted duration _raw
Please helppp !! 🙂
What about something like this instead:
... | eval start_time=if(searchmatch("Status update"),_time,null()) | streamstats last(start_time) as last_start_time | eval duration=_time-last_start_time | search "Mount"
1) We create a field start_time which if we have a start event (check out Eval Functions ), we set to the _time of the event, otherwise we don't set it at all.
2) We then use streamstats to get the most recent start time for each event
3) We then keep only the ending events
Assuming your transaction has another correlation field (e.g. a mountpoint/directory-name) which you did not specify (a big "if", I know), you can do it like this:
... | eventstats earliest(_time) AS StartTime by correlationID | search "Mount" | eval duration=_time-StartTime | table _time Update Mounted duration _raw
My transaction has not another correlation field :S..
But thank you, this search will help for other stuff 😄
What about something like this instead:
... | eval start_time=if(searchmatch("Status update"),_time,null()) | streamstats last(start_time) as last_start_time | eval duration=_time-last_start_time | search "Mount"
1) We create a field start_time which if we have a start event (check out Eval Functions ), we set to the _time of the event, otherwise we don't set it at all.
2) We then use streamstats to get the most recent start time for each event
3) We then keep only the ending events
Work perfectly, thank you 🙂