Splunk Search

How to find the difference of multiple event types in non-sequential order?

iamsplunker
Communicator

I have the data with different event types in the data say A to M.. Wanted to find time diffrence which tookfor each event

Example
index=apple source=datapipe
eventType=newyork                                   A
eventType=california                                  B     B-A
eventType=boston                                       C    C-B
eventType=houston                                    D    D-C
eventType=dallas                                        E      E-D
eventType=austin                                        F     F-D
eventType=Irvine                                         G    G-E
eventType=Washington                            H    H-F
eventType=Atlanta                                      I        I-H
eventType=San Antonio                          J         J-I
eventType=Brazil                                       K          K-I
eventType=Mumbai                                   L       L-I
eventType=Delhi                                        M        M-I

Currently I'm using |streamstats range(_time) as diff window=2 ..however it gives the sequential order of the difference.
I want the difference in time in the above format

The eventTypes are Unique and I'm using append in my search in each eventType

@sundareshr @ITWhisperer @Nisha18789 @MuS @jasongb @yuanliu @thetech @guilmxm 

Thank you

Labels (4)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is not clear why streamstats is not doing what you want or what the rationale for the differences is e.g. why F-D and not F-E?

0 Karma

iamsplunker
Communicator

Hi @ITWhisperer , Thanks for your response. I wanted to calculate time difference in the Account conversion. I have the requirement for the calculation in Given format like  F-D and not F-E . streamstats is working for the sequential order but not for non-sequential. I was wondering is there any way to accomplish this

Thanks

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It depends on how you determine which values to use - why F-D and not F-E, what is it about austin that means F-D and not F-E? Without knowing what your algorithm is for determining which results to use, it is difficult to say whether it is possible or not.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...