how to calculate time delta

[sanjeev]

how to calculate the device’s uptime value e.g time delta means time between  (uptime < 1800) up to next (uptime < 1800). (note: if the next uptime is not found then just calculate time up to end period).

[richgalloway]

What do you mean by "uptime < 1800"?
Can you share some sample data?

[sanjeev]

2020-07-14 06:43:37.0,0,ERROR,000000000000,na,na,na,na,na,na,na,na,"""na""",na,na,"{""bootid"":0,""deviceid"":""BC10164B002952"",""mac"":""9021063d8898"",
""payload"":{""CPU"":[2,9,85],""Mem"":[253360,124120],""CmsLock"":{""PID"":0,""Dur"":0,""PName"":""NULL"",""Fn"":""NULL""},""IFStat"":{""eth0.1"":[320838754,252147895],
""br0"":[413300414,21771493],""wl1"":[0,430467720],""wds1.2"":[51152432,2323764265],""wl0"":[437899257,6876453],""wds1.1"":[580685048,116947992],""eth0"":[3680810744,927584233]},
""Eth"":{""0"":{""Type"":""100baseTx-FD."",""LinkUp"":1}},,""Temp"":[45,62]},""model"":""EE120"",""region"":""UK"",""resetid"":""FIRM_FUS"",""sw"":""2.20.2747.R"",
""topic"":""HCTELEM"",""uptime"":271031,""utc"":1594705390,""vc"":""na"",""wakereason"":""na"",""ver"":2}"

this is basically raw data.  here uptime is 271031. so we want devices uptime value which are less than 1800. by calculating time delta (uptime < 1800) up to next (uptime < 1800). (note: if the next uptime is not found then just calculate time up to end period).

[richgalloway · Accepted solution]

Perhaps this will get you started.

index=foo "uptime"
| rex "uptime\"\":(?<uptime>\d+)"
| where uptime < 1800
| streamstats window=2 range(_time) as delta
| table _time uptime delta

[sanjeev]

Thanks for that.

there are few more requirements. Below are some of them.

• Take the memory data (freemem) from the first point and just BEFORE the next point at where the device was rebooted.
• Show the device uptime based on time calculation between the two points.
• Calculate the delta of memory (freemem) between the two points.

Reboot can be recognized by resetid

[richgalloway]

I don't have a solution for those requirements.
Finding an event immediately before another event is a challenge I've not yet overcome.