Splunk Search

How to list with events time difference greater than 0.5 secs?

msg4sunil
Path Finder

How do I list those events within a set of events(say expand the below query) wherein say 2 consecutive's event time difference is more than 0.5 secs?

index=index1 * "orderid"

 

thank you

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Simple example here

index=index1 * "orderid"
| delta _time as timeDiff
| where timeDiff < -0.5

That is simply selecting events where the earlier event is more than 0.5 seconds before the current event, but not sure if that's exactly what you're after

View solution in original post

msg4sunil
Path Finder

@bowesmana , lovely thanks a lot!

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Simple example here

index=index1 * "orderid"
| delta _time as timeDiff
| where timeDiff < -0.5

That is simply selecting events where the earlier event is more than 0.5 seconds before the current event, but not sure if that's exactly what you're after

Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...