Splunk Dev

calculate duration between events and show events with specific duration

sarit_s
Communicator

Hello

i have a list of events and a fields called ClientDateTime 
i want to show the events the their ClientDateTime is 5s between one event to another
how can i do it ?

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

More information would be helpful, but is the general idea.  First, convert ClientDateTime into epoch form (using strptime).  Sort the events by the converted value.  Then use streamstats to compute the difference between adjacent events.  Finally, use where to filter out undesired values.

index=foo ClientDateTime=*
| eval ClientDT = strptime(ClientDateTime, "<<insert appropriate format string>>")
| sort + ClientDT
| streamstats window=2 range(ClientDT) as duration
| where duration > <<some-value>>
---
If this reply helps you, Karma would be appreciated.
0 Karma

sarit_s
Communicator

this is what i tried to do 

sourcetype=clientlogs AND Mode=Real AND Action="OpenPositionRequest" AND Request_Data_View_CurrentTradingMode="REGULAR" 
| eval ClientDT = strptime(ClientDateTime, "%Y-%m-%dT%H:%M:%S.%3NZ")
| sort + ClientDT
| streamstats window=2 range(ClientDT) as duration
|table ClientDT, duration

and here are the results :

sarit_s_0-1640787335377.png

 

how can i check if duration between events is 5s ?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The duration field value is in seconds.  Use the where command to filter for a specific value.

sourcetype=clientlogs AND Mode=Real AND Action="OpenPositionRequest" AND Request_Data_View_CurrentTradingMode="REGULAR" 
| eval ClientDT = strptime(ClientDateTime, "%Y-%m-%dT%H:%M:%S.%3NZ")
| sort + ClientDT
| streamstats window=2 range(ClientDT) as duration
| where duration = 5.000000
|table ClientDT, duration
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...