Splunk Search

How to calculate time from event beginning and end.

john_kennan
Engager

I would like to display the average time Oracle is taking to perform a check point. I have filtered out the following from the log file which show the timestamp for the beginning of the check point as well as the end.

Note the common link is the SCN number. So this example below would yeild 5 seconds.

Mon Oct 24 15:06:58 2011 Completed
checkpoint up to RBA [0x1cbf.2.10],
SCN: 8494298653192

Mon Oct 24 15:06:53 2011 Beginning log
switch checkpoint up to RBA
[0x1cbf.2.10], SCN: 8494298653192

How would one go about calculating this?

Thanks!

Tags (3)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

There are several ways. First, you need to make sure SCN is extracted as a field (I call it SCN below), and that of course the time stamps on each event are correctly detected. Then, the most efficient would be:

... | stats range(_time) as duration by SCN

more transparently:

... | stats min(_time) as start max(_time) as end by SCN | eval duration=end-start

Less efficiently, but more intuitively:

... | transaction SCN

as the transaction command will automatically compute duration from the first and last event times.

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...