Hello all, I want to make a kind of sliding maxspan on transaction. What maxspan usually does in transaction is control time duration between a first event and a last one. In my case, I want to group all the events if the duration between an event and the next one is less than 20s and so on. See the example below: 00:00:01 A 00:00:12 B 00:00:23 C 00:00:45 D 00:00:47 E In this case I want to group A with B and C, and another group with D and E. By using transaction maxspan=20s, I will have A with B, and another group with C and another group with D and E. Please help me 🙂 ... View more

Hello, I try to use the latest() option of eventstats in the following way: | eventstats latest(Status) AS Status_last by Application |sort 0 _time| dedup _raw| table _time Status Status_last In fact, I used a regex to define "Status" in a log line and I want to display the Current Status (current log line) and the status value of the previous logs line. As below the problem is the Status_last raised is not good. _time Status Status_last 2015-03-31 19:28:05 DEGRADED OPERATIONAL 2015-03-31 19:29:05 OPERATIONAL OPERATIONAL <= instead of Degraded Please help ! !! ... View more

Hello all, How do I get the time between one start event and multiple end events? Let me explain: I have one start event and multiple end events and I need to see the duration between the start event and each of the end events. Currently I'm using the following search, but only raised the duration between the start event and the first end event. This search correctly displays all the other occurrences of end events, but without the durations 😞 my search | transaction startswith="Status update" endswith="Mount" keepevicted=t | sort 0 _time | table _time Update Mounted duration _raw Please helppp !! 🙂 ... View more

Hello all, I'm trying to make a slippery transaction within 20 events. For example, my search return 40 events and I need to calculate the duration between: the first event and the twentieth, the second and the twenty first, the third and the twenty second etc... With this: transaction Routed maxevents=20 mvlist=t Splunk only calculates 2 durations: between the first event and the twentieth, and the twenty first and the fortieth. Please HELPPP 🙂 ... View more