Getting Data In

How calculate the delta between the timestamp in one row with the timestamp in the previous row for all results?

Brigno
New Member

Hi,

In my search result, I have a series of events. I am able to calculate the delta of the various _time timestamps between each event, but how can I calculate the delta dividing the result in pairs? For example, I have 6 timestamps:

1 - 22/02/16 14:50:00.000
2 - 22/02/16 14:50:30.000
3 - 22/02/16 14:50:38.000
4 - 22/02/16 14:50:59.000
5 - 22/02/16 14:53:06.000
6 - 22/02/16 14:54:00.000
...

I need the delta between line 1 and line 2, then between line 3 and line 4, and so on for the entire result. Someone knows how to do something like this?

0 Karma

woodcock
Esteemed Legend

Like this:

Your Base Search Here
| streamstats count AS serial
| eval copy_time=if(serial%2==1, _time, null())
| streamstats current=f last(copy_time) AS last_time
| eval delta = if(isnull(copy_time), tostring(last_time - _time, "duration"), null())
0 Karma

Stevelim
Communicator

Have you considered the Delta command?

[your search] | delta _time as OnSince  | eval OnSince = tostring (OnSince, "duration")
0 Karma

Brigno
New Member

Yes, I do. I know it, but it's not what I'm looking for. That command make a delta between line 1-2, 2-3, 3-4. 4-5 and so on, but what I really need is a delta between lines 1-2, 3-4, 5-6 etc.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...