Splunk Search

How do I report on timestamps for earliest and latest field values for multiple events in a search?

aramakrishnan
New Member

I have a list of logs that are relevant to a specific sourcetype and serial Number. My search results in the following types of logs which have mutiple phase values. My logs look like the following and naturally show up in chronological order (latest first) from the search query:

Search: sourcetype="loglist" serialnum="n1234" segmentid="15"

Logs:
...serialnum="n1234"..."segmentid=15", host="abcd", phase="precall",
...serialnum="n1234"..."segmentid=15", host="abcd", phase="callexcept",
...serialnum="n1234"..."segmentid=15", host="abcd", phase="precall",
...serialnum="n1234"..."segmentid=15", host="abcd", phase="callresult",
...serialnum="n1234"..."segmentid=15", host="abcd", phase="precall",

I'm interested in getting (1) the timestamps and (2) the duration for the earliest or latest combination of precall and callresult logs. i.e., the time difference between the earliest log with phase="precall" and earliest log with phase="callresult". I would like to be able to (2) repeat this with the latest combinations and (2) scale this query to all serialnumbers and their corresponding segmentids within the sourcetype.

I tried this:
sourcetype="loglist" serialnum="N1234" segmentid="15"| stats earliest(eval(phase="precall")) as d1 earliest(eval(phase="callresult")) as d2| eval k1=d1 | eval k2=d2| transaction startswith(k1) endswith (k2) | table duration

Splunk identifies the events, but it's unable to perform any calculations on it. I'm basically trying to assign the earliest precall and callresult logs to a new field so that I can calculate duration based of that. Any thoughts on how I can modify this search would help! Thanks!

Tags (2)
0 Karma

woodcock
Esteemed Legend

This should work:

sourcetype="loglist" | stats earliest(eval(phase="precall")) as d1 earliest(eval(phase="callresult")) as d2 by serialnum,segmentid | eval duration=d2-d1
0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

Right now, you're using stats which gathers everything up into buckets as designated. What it sounds like you are looking for is THE earliest as a single value and then do something with that value... so you want streamstats. it uses the same functions.

If that doesn't do it for you or at least make sense... you might want to explain the statement "unable to perform any calculations on it". Like what?

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...