Getting Data In

Calculating time difference between two fields of the same name in two sourcetypes

asarolkar
Builder

All,

I have two logs with sourcetype="alphalog" and sourcetype="betalog" with the generic timestamp _time present.

I am joining them on a field called accountId.

What I want to do is to be able to find the difference between the "_time" values if possible ?

How do I find the time difference (epoch time is fine too) between two _time values in two difference log files ?

Tags (3)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

Although it might not be the fastest, you can use "transaction".

sourcetype="alphalog" OR sourcetype="betalog" | transaction accountId maxspan=10m| timechart duration by accountId

Transaction calculates the duration in seconds for each transaction.

You can also do a stats and eval:

sourcetype="alphalog" OR sourcetype="betalog" | stats latest(_time) as lt earliest(_time) as et by accountId| eval duration = lt - et| table duration accountID

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

Although it might not be the fastest, you can use "transaction".

sourcetype="alphalog" OR sourcetype="betalog" | transaction accountId maxspan=10m| timechart duration by accountId

Transaction calculates the duration in seconds for each transaction.

You can also do a stats and eval:

sourcetype="alphalog" OR sourcetype="betalog" | stats latest(_time) as lt earliest(_time) as et by accountId| eval duration = lt - et| table duration accountID

kallu
Communicator

It's all in manuals 🙂

Let's say you have a set of events where the IP address is extracted to either clientip or ipaddress. This example defines a new field called ip, that takes the value of either clientip or ipaddress, depending on which is not NULL (exists in that event):

... | eval ip=coalesce(clientip,ipaddress)

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

asarolkar
Builder

Hi,

I have a stupid question for followup 🙂 !

What if the field was named accountNumber in alphalog and accountId in betalog, how would the searches that you suggested change (obviously a join is involved)

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...