I am kind of new to Splunk and unfortunately I ran out of Ideas how to solve the problem i'm facing.
I need to know the Time between two events with the same Values. Is that possible?
| transaction testparam mvlist=t startswith=eval(value="1") endswith=eval(value="1") | table duration
value is a trigger in the testdata.
Is there maybe some sort of join I could use, or an option like minpause.
If anyone has an idea how to solve this or a clue, I'll be very thankful.
try something like this:
<your base search here> value="1" | stats earliest(_time) AS e_time latest(_time) AS l_time | eval duration=l_time-e_time | convert crime(duration) | ...
maybe you need to add a
by clause to the stats and any further needed fields. But this should do the job for you.
hope this helps ...
thank you for fast response
the Problem within this is that i get the earliest and the latest value="1".
What i need is that the Value="1" (endswith) appears in the next transaction as Value="1"(startswith).
I need the duration time between every Value="1" 's.
Another solution which would help would be to include a different Value="2" in the Middle, which exists in the data and is always between the 1's.
What i tried to do so is following.
index="test" | transaction param mvlist=t startswith=eval(Value="1") endswith=eval(Value="2") | table param Create_time Value | append [search index="test" | transaction param mvlist=t startswith=eval(Value="2") endswith=eval(Value="1") | eval mvindex(Value,-1) = 77 ] | table param Create_time Value
then my next step would have been to combine or make a transaction from Value="1" to Value="77" but the assignment eval mvindex()=77 doesnt work.
Maybe you have another suggestion?