Splunk Search

create lagtime panel with average time between two string value datetime fields

jdepp
Path Finder

I have two datetime fields that I would like to use to calculate average lagtime as each message coming contains these fields. I would like to display some sort of panel showing this in seconds.

pubDate:"2014-04-30 11:27:49"   scrapeDate:"2014-04-30 11:27:53"

any help appreciated.

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
... | eval pubDate="2014-04-30 11:27:49" | eval scrapeDate="2014-04-30 11:27:53" | eval ipubDate=strptime(pubDate, "%Y-%m-%d %H:%M:%S") | eval iscrapeDate=strptime(scrapeDate, "%Y-%m-%d %H:%M:%S") | eval lagtime=round(iscrapeDate-ipubDate,0) | table pubDate, scrapeDate, lagtime
---
If this reply helps you, Karma would be appreciated.

richgalloway
SplunkTrust
SplunkTrust

Try this:

sourcetype="data.newIndex.stats" | eval ipubDate=strptime(pubDate, "%Y-%m-%d %H:%M:%S") | eval iscrapeDate=strptime(scrapeDate, "%Y-%m-%d %H:%M:%S") | eval lagtime=round(iscrapeDate-ipubDate,0) | chart max(lagtime)
---
If this reply helps you, Karma would be appreciated.
0 Karma

jdepp
Path Finder

I tried the following:
search sourcetype="data.newIndex.stats" | eval ipubDate=strptime(pubDate, "%Y-%m-%d %H:%M:%S") | eval iscrapeDate=strptime(scrapeDate, "%Y-%m-%d %H:%M:%S") | eval lagtime=round(iscrapeDate-ipubDate,0) | table pubDate, scrapeDate, lagtime

I used a dial gauge on my panel but get the following message:
These results may be truncated. This visualization is configured to display a maximum of 1000 results per series, and that limit h

I would like the above query to only return the max result

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...