Splunk Search

How to extract time interval between each near two events?

JSIrony
Loves-to-Learn Lots

hi, I'm finding how to calculate each time difference from near 2 events

 

for example,

if my search output is

f1    datetime

A     ~~ 09:00

A    ~~ 10:00

A    ~~ 15:00

B    ~~ 06:00

B    ~~ 08:30

 

I want a table like

A 1:00

A 5:00

B 2:30

 

I prefer to print it without making big temporary output table(for look-up or etc) if I can

can I get some ideas?

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming you have the times (_time) in epoch format

| streamstats range(_time) as timediff window=2 global=f by f1
| where timediff>0
| eval timediff=tostring(timediff,"duration")
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Are you looking for delta?

| delta _time as timedelta
0 Karma

JSIrony
Loves-to-Learn Lots

thanks :slightly_smiling_face:

 

I considered about delta, but it can't be grouped by another field (like f1 in question i wrote)

 

now I'm trying using streamstats-range-window=2 with time sorted table like this

| streamstats window=2 range(_time) by f1

 

are there other better solutions? 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

If groupby is a requirement (not quite clear in OP), streamstats is the answer.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...