Splunk Search

how to calculate time delta

sanjeev
Explorer

how to calculate the device’s uptime value e.g time delta means time between  (uptime < 1800) up to next (uptime < 1800). (note: if the next uptime is not found then just calculate time up to end period).

 

 

Labels (3)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Perhaps this will get you started.

index=foo "uptime"
| rex "uptime\"\":(?<uptime>\d+)"
| where uptime < 1800
| streamstats window=2 range(_time) as delta
| table _time uptime delta
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust
What do you mean by "uptime < 1800"?
Can you share some sample data?
---
If this reply helps you, Karma would be appreciated.
0 Karma

sanjeev
Explorer

2020-07-14 06:43:37.0,0,ERROR,000000000000,na,na,na,na,na,na,na,na,"""na""",na,na,"{""bootid"":0,""deviceid"":""BC10164B002952"",""mac"":""9021063d8898"",
""payload"":{""CPU"":[2,9,85],""Mem"":[253360,124120],""CmsLock"":{""PID"":0,""Dur"":0,""PName"":""NULL"",""Fn"":""NULL""},""IFStat"":{""eth0.1"":[320838754,252147895],
""br0"":[413300414,21771493],""wl1"":[0,430467720],""wds1.2"":[51152432,2323764265],""wl0"":[437899257,6876453],""wds1.1"":[580685048,116947992],""eth0"":[3680810744,927584233]},
""Eth"":{""0"":{""Type"":""100baseTx-FD."",""LinkUp"":1}},,""Temp"":[45,62]},""model"":""EE120"",""region"":""UK"",""resetid"":""FIRM_FUS"",""sw"":""2.20.2747.R"",
""topic"":""HCTELEM"",""uptime"":271031,""utc"":1594705390,""vc"":""na"",""wakereason"":""na"",""ver"":2}"

 

 

this is basically raw data.  here uptime is 271031. so we want devices uptime value which are less than 1800. by calculating time delta (uptime < 1800) up to next (uptime < 1800). (note: if the next uptime is not found then just calculate time up to end period).

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps this will get you started.

index=foo "uptime"
| rex "uptime\"\":(?<uptime>\d+)"
| where uptime < 1800
| streamstats window=2 range(_time) as delta
| table _time uptime delta
---
If this reply helps you, Karma would be appreciated.

sanjeev
Explorer

Thanks for that.

there are few more requirements. Below are some of them.

• Take the memory data (freemem) from the first point and just BEFORE the next point at where the device was rebooted.
• Show the device uptime based on time calculation between the two points.
• Calculate the delta of memory (freemem) between the two points.

 

Reboot can be recognized by resetid

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
I don't have a solution for those requirements.
Finding an event immediately before another event is a challenge I've not yet overcome.
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...