Splunk Search

Time between events

dturner83
Path Finder

We're trying to calculate the time between a users 1st event on our site and their 3rd event on our site. We can use transaction for SessionId or X_Forwarded_For for tracking purposes but I've got no idea how to grab 1st event and 3rd event.

I use the following to get their first and last easy enough.
[search] | stats earliest(time) as start, latest(time) as stop by X_Forwarded_For, ASP_NET_SessionId

I'm assuming using transaction on X_Forwarded_For or ASP_NET_SessionId would work I'm just not sure how to grab the time difference between the first and 3rd events.

Tags (1)
0 Karma

somesoni2
Revered Legend

Try this. (I am assuming when you say 1st and 3rd for a user, mean 1st and 3rd for a session Id, please update the column if its otherwise)

your base search | streamstats count as sno by ASP_NET_SessionId | where sno=1 OR sno=3 | fields - sno | further search command

At this point of time your should get 1st and 3rd event for a ASP_NET_SessionId. You can add more combination if applies. Use transaction (or stats command how you used in your question) to get the duration.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

How about inserting 'head 3' before your 'stats' command?

---
If this reply helps you, Karma would be appreciated.
0 Karma

dturner83
Path Finder

head 3 will grab the last 3 events and then do the stats command on those results. Next logical step there for me would be head 3 by X_Forwarded_For but unfortunately you can't do that with the head command.

0 Karma
Get Updates on the Splunk Community!

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...