Splunk Search

duration for first event and last event

newbiesplunk
Path Finder

Hi,
If i wish to find out the duration for the first event and the last event in hour, minutes and second, what would be the likely approach?

Tags (1)
0 Karma

Runals
Motivator

There are two elements to your question and likely a number of similar questions on the boards. What I understand the first part of your question to be is how do you get the duration between the first and last event. There are two general approaches. The first, and most common, is the transaction command which will output a duration field as seconds between the two timestamps. It might look something like this

sourcetype=foo | transaction startswith=<event1> endswith=<event2>

An alternative is a stats command where you are grouping the events by a common field. This might run a bit faster than transaction but transaction has more nuanced options.

sourcetype=foo <event1> OR <event2> | stats max(_time) as second_event min(_time) as first_event by <some field(s) the events have in common like maybe IP> | eval diff = second_event - first_event

The next piece is converting seconds to hours, min, sec etc. I have a generic case statement I tend to use - adjust to your particular needs. You don't need the round() function for each evaluation but I was young and dumb when I created it and what you don't see are the stats commands that typically come before this eval. I should probably make it even more generic /shrug.

eval elapsed_time = case(round(duration)<=60,round(duration)." sec", round(duration)<=3600, round(duration'/60,1)." min",round(duration)<=86400, round(duration/3600,1)." hours", round(duration)>86400, round(duration/86400,1)." days", 1=1, "fixme")

To put it all together then it might look like

sourcetype=foo | transaction startswith=<event1> endswith=<event2> | eval elapsed_time = case(round(duration)<=60,round(duration)." sec", round(duration)<=3600, round(duration'/60,1)." min", round(duration)<=86400, round(duration/3600,1)." hours", round(duration)>86400, round(duration/86400,1)." days", 1=1, "fixme") | table <fields of interest> duration elapsed_time
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...