Splunk Search

duration in each state for specific time range

rferrante
New Member

Hi,
What would be the best approach for building a query that for a given time-range gives for each device the amount of time in each state?

I have a system that tosses in logs with "Timestamp, DeviceName, NewState" upon each state change.
e.g.
Time=03/17/2012 16:00:23;DeviceName=ABC;Down
Time=03/18/2012 14:16:23;DeviceName=ABC;Up
Time=03/18/2012 14:19:23;DeviceName=ABC;Down
Time=03/18/2012 14:21:23;DeviceName=ABC;On-Backup
Time=03/18/2012 18:49:23;DeviceName=ABC;Up
...

For example, from 3/18/2012 12:00:00 - 3/18/2012 15:00:00 could you give me a query that would yield:
Device;State;
ABC;UP; 3 minutes = 00:03:00
ABC;Down;2min (from outage in middle) + 02:16:23 (from 12:00:00 til it went up at 14:16:23) = 02:18:23
ABC;On-Backup;00:38:37 (from 14:21:23 - 15:00:00)

Tags (3)
0 Karma

GKC_DavidAnso
Path Finder

Hi

Not exactly what you asked for, but you could try something like this:
DeviceName=* |transaction DeviceName startswith=Down endswith=Up |table _time duration
That will give how long it was down for.

Or to see how long it's been on battery try this:
DeviceName=* | transaction DeviceName startswith=On-Backup max-events=2 | table _time duration

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...