Splunk Search

How to edit search to find the amount time an event is in multi states?

sarfarajsayyad
New Member

I have an index with 30+ fields. One of the field is state. I want to find amount of time an event is in a particular states (comma separated states).

I have a macro like below

[TimeInState(1)]
args = States
join type=left data_id [search index="data_log" log_msg="State Established: $States$" | dedup log_id | sort 0 _time by id | delta _time as "offclock" p=1 | ......remaining search query
iseval = 0

This macro is working fine with single input (States="Open"). What changes i need to do to work with multiple comma separated states(States="Open,Working")?

I have tried using | makemv delim="," states | top states | but no success
and another issue is i want to do this before first pipe ( | ). i.e search index="datat_log" log_msg="State Established: $TicketStates$" Some logic here

Any advice and suggestions will be greatly appreciated
/Sarfaraj

0 Karma

maciep
Champion

Maybe you can use a subsearch to transform the States parameter the way you want? For example:

join type=left data_id [search index="data_log" [| stats count | eval log_msg =split($States$,",") | mvexpand log_msg | eval log_msg="State Established: " . log_msg | fields - count] | dedup log_id | . . . 

You'll probably have to change the logic around the rest of the query to account for multiple states though I think.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...