How to compare values based on other fields

[ckdoan]

Hi all,

So I'm working with log files, and here's a sample entry,

---

8:09:03 IN: "field1" "user1"

8:09:04 IN: "field2" "user2"
8:09:20 OUT: "field1" "user2"

8:09:25 OUT: "field1" "user1"

8:12:03 IN: "field1" "user1"
8:13:03 OUT: "field1" "user1"
etc...

---

(the time is inside the event as well)

What I want to do is compare the amount of time that the user is online when and only if field1 is the same. Ie. for the above example, user1 is online for 1 minute and 22 seconds (in total) .

As you can see, sometimes the events do not occur consecutively to each other. (see bold) So based upon the time stamp, I want to see the next time it ends.

Lastly, I want to chart this so that the chart will display when the user is online throughout a day and when they're not online.

Thanks.

Ps, I'm quite new at splunk, please provide a lot of detail.

[sk314]

Have you tried using the transaction command on "field" and "user"? Ref: http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Transaction

• The transaction command adds a duration field that you could use.

[ckdoan]

Hi, yeah I've already grouped all my data using the transaction command, not quite sure how to proceed from there.

[Richfez]

To expand on sk314's answer:

If you use

... my base search ... | transaction maxpause=30m maxspan=1h field, user

As your search, when run it should create a field called duration that is the length of each transaction. It's just there. If you'd like, you could take the above and add to the end of it | table field, user, duration to get a shorter, easier to read table.

Alternatively, if you want to see the duration in other formats check out the fieldformat function. You could do something like

... my base search ... | transaction ... | fieldformat duration=fieldformat(duration, "duration")

Other possibilities exist. What is it you are trying to do that we haven't answered?

[ckdoan]

Well it's more like, I'm not able to properly group the data into a transaction. For example, each transaction should ideally contain only one instance of the time that the user logins and logouts to get that duration (2 events) and then repeat for the rest with the same field1. Right now, my transaction groups all the INs together and then separated by field1 which is not what I want.