Splunk Search

Find differences in time between events with some shared field values in a subsearch

brajaram
Communicator

We have our logs in JSON structured data. Events contain the following fields Time, ID, Client

I am trying to compare the times between events of different clients that contain the same ID. My query thus far:

index=... Client=A [ search index=... Client=B| table id]

This correctly finds all events with Client=A that occurs in Client=B. However, what I want to do is find the difference of Time between the events of the subsearch and the events of the primary search across ID. (i.e if 10 different IDs have a time of 1, 2, 3 for client A..., and a time of 2, 3, 4... for client B, I want a table that says ID TimeDiff so I can get summary statistics of the difference. I think I need to be using the delta command, but not sure how to set up the data to get that.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try (the chart command will create fields with name same as value of field Client, so update the where and eval command accordingly)

index=... Client=A OR Client=B [search index=... Client=B| table ID]
| fields _time ID Client
| chart values(_time) over ID by Client
| where isnotnull('A') AND isnotnull('B')
| eval TimeDiff='B' - 'A'

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Give this a try (the chart command will create fields with name same as value of field Client, so update the where and eval command accordingly)

index=... Client=A OR Client=B [search index=... Client=B| table ID]
| fields _time ID Client
| chart values(_time) over ID by Client
| where isnotnull('A') AND isnotnull('B')
| eval TimeDiff='B' - 'A'

brajaram
Communicator

That worked perfectly. I never even knew the chart functionality worked like that, but seeing it produce the output makes a lot more sense, but I never would have been able to figure that out at all. Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...