Splunk Search

Transaction By Day

sanjay_shrestha
Contributor

Events are looked like:

2/4/2014 00:00:01 –Something else
2/4/2014 04:00:01 – Restarted
2/4/2014 05:59:59  - Something else
2/4/2014 08:59:59  - Something else
2/4/2014 10:00:01 – Paused
2/4/2014 13:59:59  - Something else
2/4/2014 13:59:59  - Something else
2/4/2014 14:00:01 – Restarted
2/4/2014 15:59:59  - Something else
2/4/2014 16:59:59  - Something else
2/4/2014 17:00:01 – Paused
2/4/2014 18:59:59  - Something else
2/4/2014 19:59:59  - Something else
2/4/2014 20:00:01 – Restarted
2/4/2014 23:59:59  - Something else


2/5/2014 00:00:01 –Something else
2/5/2014 04:00:01 – Paused
2/5/2014 05:59:59  - Something else
2/5/2014 08:59:59  - Something else 
2/5/2014 13:59:59  - Something else
2/5/2014 13:59:59  - Something else
2/5/2014 14:00:01 – Restarted
2/5/2014 15:59:59  - Something else
2/5/2014 16:59:59  - Something else
2/5/2014 17:00:01 – Paused
2/5/2014 18:59:59  - Something else
2/5/2014 19:59:59  - Something else
2/5/2014 20:00:01 – Restarted
2/5/2014 23:59:59  - Something else

And I am trying to get total paused time by Day.

So, my results would be:

2/4/2014 – 7h

2/5/2014 – 13 h

I tried following but could not get by Day, events with different days are overlapping.

index=my_index earliest=-2d ("Paused" OR "Restarted")| eval Day=strftime(_time,"%Y-%m-%d")| transaction startswith="Paused" endswith="Restarted" | stats sum(duration) as PausedTime by Day

Tags (1)
0 Karma
1 Solution

araitz
Splunk Employee
Splunk Employee

Splunk contains date metadata, so you do not need to calculate the day.

index=my_index earliest=-2d ("Paused" OR "Restarted")| transaction date_mday date_month startswith="Paused" endswith="Restarted" | stats sum(duration) as PausedTime by date_mday date_month

View solution in original post

araitz
Splunk Employee
Splunk Employee

Splunk contains date metadata, so you do not need to calculate the day.

index=my_index earliest=-2d ("Paused" OR "Restarted")| transaction date_mday date_month startswith="Paused" endswith="Restarted" | stats sum(duration) as PausedTime by date_mday date_month

sanjay_shrestha
Contributor

Thanks. It worked.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...