Splunk Search

## How to sort contiguous _time into discreet sets?

Path Finder

I'm trying to collapse a of data into earliest/lastest by _time,  with the time is contiguous.

Such as:
2022-08-27 07:36:00
2022-08-27 07:37:00
2022-08-27 07:38:00
2022-08-27 07:39:00
2022-08-27 07:40:00
2022-08-27 07:44:00
2022-08-27 07:45:00
2022-08-27 07:46:00
2022-08-27 08:31:00
2022-08-27 08:32:00
2022-08-27 08:33:00
2022-08-27 08:34:00
2022-08-27 08:35:00

earliest:                               latest:

2022-08-27 07:36:00   2022-08-27 07:40:00
2022-08-27 07:44:00   2022-08-27 07:46:00
2022-08-27 08:31:00   2022-08-27 08:35:00

THoughts?

Labels (2)

• ### stats

Tags (2)
1 Solution
SplunkTrust

Assuming your _time fields are already align or binned to the minute and are in ascending order, try something like this:

``````| streamstats range(_time) as previous_gap window=2
| reverse
| streamstats range(_time) as next_gap window=2
| where previous_gap != 60 OR next_gap != 60
| streamstats current=f window=1 values(_time) as latest
| where next_gap=60
| reverse
| rename _time as earliest
| fields earliest latest
| fieldformat earliest=strftime(earliest,"%F %T")
| fieldformat latest=strftime(latest,"%F %T")``````
SplunkTrust

Assuming your _time fields are already align or binned to the minute and are in ascending order, try something like this:

``````| streamstats range(_time) as previous_gap window=2
| reverse
| streamstats range(_time) as next_gap window=2
| where previous_gap != 60 OR next_gap != 60
| streamstats current=f window=1 values(_time) as latest
| where next_gap=60
| reverse
| rename _time as earliest
| fields earliest latest
| fieldformat earliest=strftime(earliest,"%F %T")
| fieldformat latest=strftime(latest,"%F %T")``````
Path Finder

Outstanding sir - thank you! I would have never come up with that.

Get Updates on the Splunk Community!

#### Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...

#### Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

#### Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...