Splunk Search

Make a slippery transaction within 20 events, how do I calculate the duration between the 1st and 20th event, 2nd and 21st, etc?

collier31200
Explorer

Hello all,

I'm trying to make a slippery transaction within 20 events.
For example, my search return 40 events and I need to calculate the duration between:
the first event and the twentieth,
the second and the twenty first,
the third and the twenty second
etc...

With this:

transaction Routed maxevents=20 mvlist=t

Splunk only calculates 2 durations: between the first event and the twentieth, and the twenty first and the fortieth.

Please HELPPP :slightly_smiling_face:

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

If you're only looking for the duration you can use this:

index=foo sourcetype=bar Routed=* | streamstats window=20 global=f range(_time) as duration by Routed

Note, the first nineteen events may compute the duration between 1 and 1, 1 and 2, ..., 1 and 19.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

If you're only looking for the duration you can use this:

index=foo sourcetype=bar Routed=* | streamstats window=20 global=f range(_time) as duration by Routed

Note, the first nineteen events may compute the duration between 1 and 1, 1 and 2, ..., 1 and 19.

collier31200
Explorer

Thanks a lot, perfectly doing what I want :slightly_smiling_face:
I used:
where row >20
to remove the twenty first events

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...