Splunk Search

How to sort contiguous _time into discreet sets?

timgren
Path Finder

I'm trying to collapse a of data into earliest/lastest by _time,  with the time is contiguous. 

Such as: 
2022-08-27 07:36:00
2022-08-27 07:37:00
2022-08-27 07:38:00
2022-08-27 07:39:00
2022-08-27 07:40:00
2022-08-27 07:44:00
2022-08-27 07:45:00
2022-08-27 07:46:00
2022-08-27 08:31:00
2022-08-27 08:32:00
2022-08-27 08:33:00
2022-08-27 08:34:00
2022-08-27 08:35:00


earliest:                               latest:

2022-08-27 07:36:00   2022-08-27 07:40:00
2022-08-27 07:44:00   2022-08-27 07:46:00
2022-08-27 08:31:00   2022-08-27 08:35:00

THoughts? 

Labels (2)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Assuming your _time fields are already align or binned to the minute and are in ascending order, try something like this:

| streamstats range(_time) as previous_gap window=2
| reverse
| streamstats range(_time) as next_gap window=2
| where previous_gap != 60 OR next_gap != 60
| streamstats current=f window=1 values(_time) as latest
| where next_gap=60
| reverse
| rename _time as earliest
| fields earliest latest
| fieldformat earliest=strftime(earliest,"%F %T")
| fieldformat latest=strftime(latest,"%F %T")

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Assuming your _time fields are already align or binned to the minute and are in ascending order, try something like this:

| streamstats range(_time) as previous_gap window=2
| reverse
| streamstats range(_time) as next_gap window=2
| where previous_gap != 60 OR next_gap != 60
| streamstats current=f window=1 values(_time) as latest
| where next_gap=60
| reverse
| rename _time as earliest
| fields earliest latest
| fieldformat earliest=strftime(earliest,"%F %T")
| fieldformat latest=strftime(latest,"%F %T")

timgren
Path Finder

Outstanding sir - thank you! I would have never come up with that. 

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...