Splunk Search

avoid latest timestamp

arjitgoswami
Explorer

Hi Team,

There is a scenario where I need to calculate time range. I have to ignore latest timestamp and need to calculate the time range for remaining records.

for eg..

17/05/2017 15:56:27.065 XXXX................
17/05/2017 15:46:27.065 YYYYY.................
17/05/2017 15:36:27.065 ZZZZZ........

so it should give me 10 mins instead of 20 mins.

can you please help? Can you please suggest how can I do that?

Thanks and regards,
Arjit goswami.

Tags (2)
0 Karma
1 Solution

dineshraj9
Builder

You can filter the first event by doing a streamstats and removing event with count=1 and then take the difference between the min and max time -

 <base search>   | streamstats count | where count!=1 | eval time=round(_time) | stats max(time) as max_time,min(time) as min_time | eval diff(mins)=strftime(max_time-min_time,"%M")

View solution in original post

0 Karma

niketn
Legend

@arjitgoswami, can you add your existing search?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

dineshraj9
Builder

You can filter the first event by doing a streamstats and removing event with count=1 and then take the difference between the min and max time -

 <base search>   | streamstats count | where count!=1 | eval time=round(_time) | stats max(time) as max_time,min(time) as min_time | eval diff(mins)=strftime(max_time-min_time,"%M")
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...