Splunk Search

How to timechart the time differences between (ITNM) events / phases?

meleschi
Explorer

I have the following data that I'm trying to timechart the differences between:

2023-02-16T16:14:04: Data Processing Phase -1 completed
2023-02-16T14:01:00: Data Processing Phase -1 starting
2023-02-16T14:01:00: Data Collection Phase 3 (Final Collection Phase) completed
2023-02-16T11:34:10: Data Collection Phase 2 starting
2023-02-16T11:34:10: Data Collection Phase 1 completed
2023-02-16T11:34:10: Data Collection Phase 3 (Final Collection Phase) starting
2023-02-16T11:34:10: Data Collection Phase 2 completed
2023-02-16T09:01:36: Data Collection Phase 1 starting

 

I've sliced up the data using the following SPL, but that will only give me a look at the time differences over the selected timeline.  I can't figure out how to slice this data up so that I'm able to timechart the differences over multiple runs of the Data Collection Phases.

| stats first(_time) as End, last(_time) as Start by Phase, PhaseIdentifier
| eval RunTime = round((End - Start) / 60, 0)
| eval Start=strftime(Start, "%c")
| eval End=strftime(End, "%c")
| rename RunTime AS "RunTime (Minutes)"

 

I'm used to working more with metrics and logs that spit out runtimes, so this has been vexing me for entirely too long...

Labels (2)
Tags (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You could use streamstats to define an identifier for each iteration. If, for example, the cycle is terminated by the Data Processing Phase -1 completed, then you can use streamstats to define the iteration count based on that occurring, e.g. this example

| makeresults 
| eval data=split(replace("
2023-02-16T16:14:04: Data Processing Phase -1 completed
2023-02-16T14:01:00: Data Processing Phase -1 starting
2023-02-16T14:01:00: Data Collection Phase 3 (Final Collection Phase) completed
2023-02-16T11:34:10: Data Collection Phase 2 starting
2023-02-16T11:34:10: Data Collection Phase 1 completed
2023-02-16T11:34:10: Data Collection Phase 3 (Final Collection Phase) starting
2023-02-16T11:34:10: Data Collection Phase 2 completed
2023-02-16T09:01:36: Data Collection Phase 1 starting
2023-02-15T16:14:04: Data Processing Phase -1 completed
2023-02-15T14:01:00: Data Processing Phase -1 starting
2023-02-15T14:01:00: Data Collection Phase 3 (Final Collection Phase) completed
2023-02-15T11:34:10: Data Collection Phase 2 starting
2023-02-15T11:34:10: Data Collection Phase 1 completed
2023-02-15T11:34:10: Data Collection Phase 3 (Final Collection Phase) starting
2023-02-15T11:34:10: Data Collection Phase 2 completed
2023-02-15T09:01:36: Data Collection Phase 1 starting", "\n", "##"), "##")
| mvexpand data
| eval _time=strptime(data, "%FT%T")
| rex field=data ": (?<Phase>Data (Processing|Collection) Phase) (?<PhaseIdentifier>-?\d+) (?<state>.*)"
| streamstats count(eval(if(PhaseIdentifier=-1 AND state="completed", 1, null()))) as iteration
| stats first(_time) as End, last(_time) as Start by iteration Phase PhaseIdentifier 
| eval RunTime = round((End - Start) / 60, 0)
| eval Start=strftime(Start, "%c")
| eval End=strftime(End, "%c")
| rename RunTime AS "RunTime (Minutes)"
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...