Splunk Search

How to get duration for the product A (only for start and end status)?

moinyuso96
Path Finder

So what I have now from my search so far

Product     Status    Time

A                   Start        8.00 AM

A                    A1            8.05 AM

A                    A2            8.15 AM

A                    End          8.20 AM

Is there anyway I can get the duration (End - Start) = 20 minutes and then display as Duration for Product A as 20 minutes?

Labels (1)
Tags (1)
0 Karma
1 Solution

renjith_nair
Legend

Try this run anywhere example

|makeresults |eval product="A"|eval status="Start A1 A2 End"|makemv status|mvexpand status
|appendcols [|makeresults|eval time="08:00 08:05 08:15 08:20"|makemv time|mvexpand time ]
|rename COMMENT as "Dummy data ends here"
|eval time=strptime(time,"%H:%M")
|stats max(eval(if(status=="Start",time,null()))) as Start_Time,max(eval(if(status=="End",time,null()))) as End_Time by product
|eval duration=round((End_Time-Start_Time)/60)

change stats to eventstats if you want to see all records in the result

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

moinyuso96
Path Finder

Thanks, it worked for me

0 Karma

renjith_nair
Legend

Try this run anywhere example

|makeresults |eval product="A"|eval status="Start A1 A2 End"|makemv status|mvexpand status
|appendcols [|makeresults|eval time="08:00 08:05 08:15 08:20"|makemv time|mvexpand time ]
|rename COMMENT as "Dummy data ends here"
|eval time=strptime(time,"%H:%M")
|stats max(eval(if(status=="Start",time,null()))) as Start_Time,max(eval(if(status=="End",time,null()))) as End_Time by product
|eval duration=round((End_Time-Start_Time)/60)

change stats to eventstats if you want to see all records in the result

---
What goes around comes around. If it helps, hit it with Karma 🙂
Get Updates on the Splunk Community!

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...