×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
bburns2122
Explorer
Member since: ‎08-03-2020
‎10-08-2021
Community Statistics
Posts 5
Solutions 0
Karma Given 2
Karma Received 0
Member Since ‎08-03-2020
Activity Feed
View All

Time difference between events and NULL when secon...

by in Splunk Search
‎10-07-2021 02:04 PM
‎10-07-2021 02:04 PM
I'm trying to figure out how to get the time difference between two events that use the same UUID. However, the second event doesn't always happen. How can I add to my query or alter it to show the time difference between event1 and event2 AND just make event2 NULL if it does not exist with the UUID. Here is what I have started that shows the UUID, time_start of event1, time_finish of event2 and difference. I think I might need to use the transaction command instead of stats but would like to avoid anything too resource intensive. index=* sourcetype=* eventCode="event1" serviceCallUUID=* | stats latest(_time) as time_start by serviceCallUUID | join serviceCallUUID [ search index=* sourcetype=* eventCode="event2" serviceCallUUID=* | stats latest(_time) as time_finish by serviceCallUUID ] | eval difference=time_finish-time_start | eval difference=strftime(difference,"%M:%S") | eval time_finish=strftime(time_finish,"%m-%d-%Y %H:%M:%S.%f") | eval time_start=strftime(time_start,"%m-%d-%Y %H:%M:%S.%f")   Thanks! ... View more
Labels

Re: Adding Event Count to Table

by in Splunk Search
‎08-06-2020 07:28 AM
‎08-06-2020 07:28 AM
Your first suggestion was correct with one issue, there didn't need to be the extra eval in front of the other trims.  source=example "EXAMPLE" | eval Date = strftime(_time, "%m-%d-%y") | fields - _time | eval entryAmount = trim(replace(entryAmount, "'USD", "")), eval entryAmount = trim(replace(entryAmount, "'", "")), eval entryAmount=tonumber(trim(entryAmount), 10) | stats sum(entryAmount) as entryAmountDay, count as Transactions by Date This search worked: source=example "EXAMPLE" | eval Date = strftime(_time, "%m-%d-%y") | fields - _time | eval entryAmount = trim(replace(entryAmount, "'USD", "")), entryAmount = trim(replace(entryAmount, "'", "")), entryAmount=tonumber(trim(entryAmount), 10) | stats sum(entryAmount) as entryAmountDay, count as Transactions by Date   Thank you so much for your help with this! ... View more

Re: Adding Event Count to Table

by in Splunk Search
‎08-06-2020 05:51 AM
‎08-06-2020 05:51 AM
@richgalloway  It looks like that one gives me the same output that does not include the entryAmount. This is the only field in the log that includes the price amount so I'm not sure how else to 'transform' this to a usable number.     ... View more

Re: Adding Event Count to Table

by in Splunk Search
‎08-04-2020 07:17 AM
‎08-04-2020 07:17 AM
It looks like that query fails with the same issues I was having. The date and transaction field get populated but not the entryAmountDay. The entryAmountDay gets left blank. ... View more

Adding Event Count to Table

by in Splunk Search
‎08-03-2020 01:56 PM
‎08-03-2020 01:56 PM
I am trying to get the Date (altering _time in a specific format shown below), number of events (which I am using stats count to count the number of occurrences of "EXAMPLE" and renaming as Transactions), and the sum of a value from different events (which I have to trim USD and quotes in order to make it register as a number). I can get the results separately but when I try to get all three columns to show in one table, it will only give me the number of events. All fields come from the same log. I want it to look like this: ------------------------------------------------ Date                                 Transactions                                  entryAmountDay 08-02-2020                      7                                                          5000.00 ------------------------------------------------- What works separately: source=example  "EXAMPLE" | stats count | rename count AS Transactions ------------------------- source=example "EXAMPLE" | eval Date = strftime(_time, "%m-%d-%y") | fields - _time | eval entryAmount = trim(replace(entryAmount, "'USD", "")), eval entryAmount = trim(replace(entryAmount, "'", "")), eval entryAmount=trim(entryAmount) | stats sum(entryAmount) as entryAmountDay by Date I have tried many different combinations and commands but can't get anything to work. Please help! Thank you ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎10-08-2021 12:51 PM
Karma given to
View All