Splunk Search

duration in each state for specific time range

rferrante
New Member

Hi,
What would be the best approach for building a query that for a given time-range gives for each device the amount of time in each state?

I have a system that tosses in logs with "Timestamp, DeviceName, NewState" upon each state change.
e.g.
Time=03/17/2012 16:00:23;DeviceName=ABC;Down
Time=03/18/2012 14:16:23;DeviceName=ABC;Up
Time=03/18/2012 14:19:23;DeviceName=ABC;Down
Time=03/18/2012 14:21:23;DeviceName=ABC;On-Backup
Time=03/18/2012 18:49:23;DeviceName=ABC;Up
...

For example, from 3/18/2012 12:00:00 - 3/18/2012 15:00:00 could you give me a query that would yield:
Device;State;
ABC;UP; 3 minutes = 00:03:00
ABC;Down;2min (from outage in middle) + 02:16:23 (from 12:00:00 til it went up at 14:16:23) = 02:18:23
ABC;On-Backup;00:38:37 (from 14:21:23 - 15:00:00)

Tags (3)
0 Karma

GKC_DavidAnso
Path Finder

Hi

Not exactly what you asked for, but you could try something like this:
DeviceName=* |transaction DeviceName startswith=Down endswith=Up |table _time duration
That will give how long it was down for.

Or to see how long it's been on battery try this:
DeviceName=* | transaction DeviceName startswith=On-Backup max-events=2 | table _time duration

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...