Splunk Search

How to calculate the average delta between each event and the event count?

ankithnageshshe
Path Finder

Hi Splunkers,

Need a help in forming a splunk query.

Requirement: Find the time difference (delta1, delta2,delta3.......) between events by specific field.

Example:

User A  eventcount =5 [delta1, delta2, delta3, delta4,]

User B eventcount= 3 [delta1, delta2]

Thanks for the help.

Regards,
Ankith

0 Karma
1 Solution

ankithnageshshe
Path Finder

Hello,

Formed two queries which serves the purpose which are given below.

|eval abc= _time |bucket span=5m _time | stats values(abc) as time by _time fieldA
| eval a1=mvindex(time, 0), a2=mvindex(time, 1) , a3=mvindex(time, 2) , a4=mvindex(time, 3) , a5=mvindex(time, 4), a6=mvindex(time, 5)
| eval delta1=a2-a1,delta2=a3-a2,delta3=a4-a3,delta4=a5-a4,delta5=a6-a5
| WHERE delta1< 30 OR delta2 < 30 OR delta3 < 30 OR delta4 < 30 OR delta5 < 30
| fields _time fieldA delta1 delta2 delta3 delta4 delta5

This can be used to calculate the delta for 5 events in the span of 5 minutes.
You can adjust the granularity as per your requirement.

OR

| transaction maxspan=5m fieldA | WHERE eventcount > 3 |eval delta= duration/eventcount | WHERE delta < 30 | table fieldA delta eventcount

This can be used to calculate the average delta between each event and the event count.

View solution in original post

0 Karma

ankithnageshshe
Path Finder

Hello,

Formed two queries which serves the purpose which are given below.

|eval abc= _time |bucket span=5m _time | stats values(abc) as time by _time fieldA
| eval a1=mvindex(time, 0), a2=mvindex(time, 1) , a3=mvindex(time, 2) , a4=mvindex(time, 3) , a5=mvindex(time, 4), a6=mvindex(time, 5)
| eval delta1=a2-a1,delta2=a3-a2,delta3=a4-a3,delta4=a5-a4,delta5=a6-a5
| WHERE delta1< 30 OR delta2 < 30 OR delta3 < 30 OR delta4 < 30 OR delta5 < 30
| fields _time fieldA delta1 delta2 delta3 delta4 delta5

This can be used to calculate the delta for 5 events in the span of 5 minutes.
You can adjust the granularity as per your requirement.

OR

| transaction maxspan=5m fieldA | WHERE eventcount > 3 |eval delta= duration/eventcount | WHERE delta < 30 | table fieldA delta eventcount

This can be used to calculate the average delta between each event and the event count.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...