Splunk Search

How to get the Maximum and Minimum time difference between the events

ibob0304
Communicator

I have events which are in this format, where the time in the event is the _time.

8/11/2017 1:26:17 PM|Thread Id: 4756|Audit|machine1|event details
8/11/2017 2:13:33 PM|Thread Id: 4756|Audit|machine1|event details

I am trying to find the Max time, Min time between the events for that particular day. Suppose if I have 100 events and one event logged at 10am and next event logged at 11am, if that is the max delay time for that day? then it would show 1hr or 60mins. Similarly to the minimum events delay. It would be great if there is average time as well.

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

...
| streamstats current=t window=2 range(_time) AS duration BY host 
| stats min(duration) AS Min max(duration) AS Max avg(duration) AS Avg BY host

View solution in original post

woodcock
Esteemed Legend

Like this:

...
| streamstats current=t window=2 range(_time) AS duration BY host 
| stats min(duration) AS Min max(duration) AS Max avg(duration) AS Avg BY host

somesoni2
SplunkTrust
SplunkTrust

With assumption that you're selecting same type of events but for different machines, try like this

your current search
| sort _time machine
| streamstats current=f window=1 values(_time) as prev_time by machine
| eval duration=_time-prev_time 
| stats min(duration) as Min max(duration) as Max avg(duration) as Avg by machine

ibob0304
Communicator

Machines are same on each event. it gave me Max as 912 seconds and Woodcock query gave me 1214 seconds. 1214 seems to be correct.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...