Splunk Search

Time difference by grouping identical events

peeeeeeeeeeter
Engager

Suppose I have the following events.


2019-09-20 01:40:09 INFO Listener processing event with message key A1:B1:C1
2019-09-20 01:40:06 INFO Listener processing event with message key A1:B1:C1

2019-09-20 01:40:00 INFO Listener processing event with message key A1:B1:C2

2019-09-20 01:39:57 INFO Listener processing event with message key A1:B1:C2

The event patterns are exactly identical, and the events differ only by timestamp, and they come in pairs. The timestamps are the start and end time of the event.

I would like to generate a table to summarize the events, which looks like the following


Field1| Field2 | Field3| StartTime | EndTime | Duration
A1 | B1 | C1 | 2019-09-20 01:40:06 | 2019-09-20 01:40:09 | 3
A1 | B1 | C2 | 2019-09-20 01:39:57 | 2019-09-20 01:40:00 | 3

The main code block looks like the following:

source="*.log"
| rex field=_raw "message key (?<A>.*?):(?<B>.*?):(?<C>.*)"

| table A B C _time

I have tried both the transaction and stats function, but in vain, maybe I did not use them correctly.

Is there anyone who can give me some advice on what to do, any help will be highly appreciated!

0 Karma

DavidHourani
Super Champion

Hi peter with many e,

Try something like this:

 source="*.log"
 | rex field=_raw "message key (?<A>.*?):(?<B>.*?):(?<C>.*)"
 |stats earliest(_time) as StartTime latest(StartTime) as EndTime by A,B,C
 | eval duration= tostring(EndTime-StartTime,"duration")
 | table A B C StartTime EndTime duration

Let me know how that works out for you.

Cheers,
David

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...