Solved: avoid latest timestamp - Splunk Community

Splunk Search

Hi Team,

There is a scenario where I need to calculate time range. I have to ignore latest timestamp and need to calculate the time range for remaining records.

for eg..

17/05/2017 15:56:27.065 XXXX................
17/05/2017 15:46:27.065 YYYYY.................
17/05/2017 15:36:27.065 ZZZZZ........

so it should give me 10 mins instead of 20 mins.

can you please help? Can you please suggest how can I do that?

Thanks and regards,
Arjit goswami.

1 Solution

Solution

You can filter the first event by doing a streamstats and removing event with count=1 and then take the difference between the min and max time -

 <base search>   | streamstats count | where count!=1 | eval time=round(_time) | stats max(time) as max_time,min(time) as min_time | eval diff(mins)=strftime(max_time-min_time,"%M")

View solution in original post

@arjitgoswami, can you add your existing search?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Solution

You can filter the first event by doing a streamstats and removing event with count=1 and then take the difference between the min and max time -

 <base search>   | streamstats count | where count!=1 | eval time=round(_time) | stats max(time) as max_time,min(time) as min_time | eval diff(mins)=strftime(max_time-min_time,"%M")

Get Updates on the Splunk Community!

New Year. New Skills. New Course Releases from Splunk Education

A new year often inspires reflection—and reinvention. Whether your goals include strengthening your security ...

Splunk and TLS: It doesn't have to be too hard

Overview Creating a TLS cert for Splunk usage is pretty much standard openssl. To make life better, use an ...

Faster Insights with AI, Streamlined Cloud-Native Operations, and More New Lantern ...

Splunk Lantern is a Splunk customer success center that provides practical guidance from Splunk experts on key ...