Splunk Search

How to query only large difference in timestamps?

eandrus
Engager

I have a dashboard query that returns fields of a log file, and I'm only interested if the difference in time between two entries is larger than a minute.

Query:

host=Host source="Filepath" "Starting" OR "Completed" earliest=@d-9d-8h | reverse

Dashboard example.

Status 3/18/2016 7:53:47 PM: Starting
Status 3/18/2016 7:53:48 PM: Completed 0.23s.
Status 3/18/2016 7:58:56 PM: Starting
Status 3/18/2016 8:31:29 PM: Completed 1953.33s.
Status 3/18/2016 8:37:11 PM: Starting
Status 3/18/2016 8:37:11 PM: Completed 0.35s.

So, from 7:58 to 8:31, I would need to see both the "Starting" and "Completed" lines, but the rest of it can go. I've looked at a couple other questions and they didn't exactly have what I needed. Can anyone help me with this?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Something like this should do it.

host=Host source="Filepath" "Starting" OR "Completed" earliest=@d-9d-8h | transaction startswith="Starting" endswith="Completed" | where duration > 60 | reverse
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Something like this should do it.

host=Host source="Filepath" "Starting" OR "Completed" earliest=@d-9d-8h | transaction startswith="Starting" endswith="Completed" | where duration > 60 | reverse
---
If this reply helps you, Karma would be appreciated.

eandrus
Engager

Thank you, that actually has made life so much easier in about 30 different areas. Just didn't know how to group stuff like that, that's awesome, you're awesome.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...