Splunk Search

Turn Around Time Report

eulalie
New Member

So I have a bunch of data and somoene has decided they'd like to know the average turn around time for events.

I can look up the history of event a and extrapolate that it took 15 mins to go from state X to state Y; but how to I write a query that will find the average time between state x and state y for all events in a given time frame?

Tags (1)
0 Karma

lguinn2
Legend

Okay, I will assume that events look something like this

[timestamp] identifier=A info state=X
[timestamp] identifier=B info state=X
[timestamp] identifier=A info state=Y
[timestamp] identifier=C info state=X
[timestamp] identifier=A info state=Y
[timestamp] identifier=C info state=Y

And additional assumptions must be made: X is always the first state and Y is always the last state. Each identifier is something like a unique transaction id, that can occur only once for each state.
Try this:

yoursearchhere
| stats range(_time) as duration count by identifier
| where count > 1
| stats avg(duration) as AvgEventDuration

The where count > 1 will eliminate partial events. Partial events will occur if a particular identifier is in state X now, but has not yet gone to state Y.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...