Hello Splunk ES experts ,
I want to make a query which will produce MTTD (something like by analyzing the time difference between when a raw log event is ingested ( and meets the condition of a correlation search ) and when a notable event is generated based on the correlation search , I have tried something below but it does not give me results I am expecting because it is not calculating time difference for those notables which are in New status , below is working fine for any other status . Can someone please help me on this , may be it is too simple to achieve and I am making this complex
index=notable
| eval
orig_epoch=if(
NOT isnum(orig_time),
strptime(orig_time, "%m/%d/%Y %H:%M:%S"),
'orig_time'
)
| eval
event_epoch_standardized= orig_epoch,
diff_seconds='_time'-'event_epoch_standardized'
| fields + _time, search_name, diff_seconds
| stats
count as notable_count,
min(diff_seconds) as min_diff_seconds,
max(diff_seconds) as max_diff_seconds,
avg(diff_seconds) as avg_diff_seconds
by search_name
| eval
avg_diff=tostring(avg_diff_seconds, "duration")
| addcoltotals labelfield=search_name
... View more