Deployment Architecture

Using clustering to calculate start and end of a process

andreafebbo
Communicator

Hi all

I have some events which represent something like a ping.

For example :
_time: a time stamp
doing it: 1
database: db1
server: server1

so i get something like this:

alt text

the color represent the DB.
Now, what i need to do is to write a query which understands that there are 2 groups of events for the violet db and that gives me that _time of the first event and the rime od the last event of every group, like in the next image.

alt text

I think this can be achieved using clustering, just i dont know how (maybe with k means method).

Can you help me?

0 Karma

woodcock
Esteemed Legend

Like this:

... | transaction max_pause=5m database server | eval start = _time, end = _time + duration
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give transaction command a try.

your base search | transaction database server | eval start=_time | eval end=_time+duration
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...