Splunk Search

How do I report on timestamps for earliest and latest field values for multiple events in a search?

aramakrishnan
New Member

I have a list of logs that are relevant to a specific sourcetype and serial Number. My search results in the following types of logs which have mutiple phase values. My logs look like the following and naturally show up in chronological order (latest first) from the search query:

Search: sourcetype="loglist" serialnum="n1234" segmentid="15"

Logs:
...serialnum="n1234"..."segmentid=15", host="abcd", phase="precall",
...serialnum="n1234"..."segmentid=15", host="abcd", phase="callexcept",
...serialnum="n1234"..."segmentid=15", host="abcd", phase="precall",
...serialnum="n1234"..."segmentid=15", host="abcd", phase="callresult",
...serialnum="n1234"..."segmentid=15", host="abcd", phase="precall",

I'm interested in getting (1) the timestamps and (2) the duration for the earliest or latest combination of precall and callresult logs. i.e., the time difference between the earliest log with phase="precall" and earliest log with phase="callresult". I would like to be able to (2) repeat this with the latest combinations and (2) scale this query to all serialnumbers and their corresponding segmentids within the sourcetype.

I tried this:
sourcetype="loglist" serialnum="N1234" segmentid="15"| stats earliest(eval(phase="precall")) as d1 earliest(eval(phase="callresult")) as d2| eval k1=d1 | eval k2=d2| transaction startswith(k1) endswith (k2) | table duration

Splunk identifies the events, but it's unable to perform any calculations on it. I'm basically trying to assign the earliest precall and callresult logs to a new field so that I can calculate duration based of that. Any thoughts on how I can modify this search would help! Thanks!

Tags (2)
0 Karma

woodcock
Esteemed Legend

This should work:

sourcetype="loglist" | stats earliest(eval(phase="precall")) as d1 earliest(eval(phase="callresult")) as d2 by serialnum,segmentid | eval duration=d2-d1
0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

Right now, you're using stats which gathers everything up into buckets as designated. What it sounds like you are looking for is THE earliest as a single value and then do something with that value... so you want streamstats. it uses the same functions.

If that doesn't do it for you or at least make sense... you might want to explain the statement "unable to perform any calculations on it". Like what?

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...