Splunk Search

how to use Delta with Stats command or subtract list of time in stats list


hi Every one i am new to splunk , but here my query goes:

Sample Data and json : 

{id: 1 , executor: "executor1" , timestamp:2020-07-16T02:02:02.566}

{id: 1 , executor: "executor2" , timestamp:2020-07-16T02:02:02.570}

now my requirement is to group and list the data by id  and also calculate the timestamp difference between executor1 and executor 2 (as they are sequential steps and logging is also done sequentially)

so i did  " stats list(executor)  as executors , list(timestamp) as logtime by id " .
and the table comes like this:-

id | executors | logtime

1 | executor 1| 2020-07-16T02:02:02.566

    | executor 2 |2020-07-16T02:02:02.570
now i want to calculate the difference between the logtime or timestamp of executors and apply it on stats command only . P.s. number of executors can increase dynamically

required  result:-

id | executors | logtime | time difference 

1 | executor 1| 2020-07-16T02:02:02.566 | 0

    | executor 2 |2020-07-16T02:02:02.570| 0.004



P.s. the above is the description of 1 row only with 4 columns

thanks in advance

Labels (3)
Tags (3)
0 Karma

Ultra Champion
index=_internal |head 2 | fields _raw _time | streamstats count
| eval _raw=if(count=1,"{id: 1 , executor: \"executor1\" , timestamp:2020-07-16T02:02:02.566}","{id: 1 , executor: \"executor2\" , timestamp:2020-07-16T02:02:02.570}")
| rename COMMENT as "the logic" 
| rex max_match=0 "(?<fieldname>\w+):\s?(?<value>\S+)(}| )"
| eval _raw=mvzip(fieldname,value,"=")
| kv
| eval _time=strptime(timestamp,"%FT%T.%3N")
| fields - fieldname value 
| delta _time as time_diff
| fillnull time_diff
| table id  executor  timestamp  time_diff
| rename executor as "executors" ,timestamp as logtime ,time_diff as "time difference"
0 Karma


Hi @sdk32 ,

This should do the Job:

| streamstats window=2 range(logtime) as time_difference

Hope it works.


Karma and/or Solution tagging appreciated.
0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...