Hi,
I am getting events in the form of:
__time, app_name, action,udid
"2013-04-11 23:26:32","nxTomo HK V0.9","game_start","1234"
I wish to group them by udid and find the time in seconds between the first and second event,
even if there are more than 2 events in an group.
The rest of the events should be ignored.
Can someone help me do this efficiently?
I tried this and it seems to work.
action=app_start | streamstats avg(_time) as prevendtime window=1 current=f global=false by udid | eval timegapsecs=abs(round(_time - prevendtime,0)) | reverse | dedup 1 udid
Can anyone comment on the efficiency or correctness of this?
I tried this and it seems to work.
action=app_start | streamstats avg(_time) as prevendtime window=1 current=f global=false by udid | eval timegapsecs=abs(round(_time - prevendtime,0)) | reverse | dedup 1 udid
Can anyone comment on the efficiency or correctness of this?
Hi, I think Example 6 here is what you want... http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Eval#Example_6
Not exactly.
Let's say I have 3 app starts. They will all be grouped together and the duration will measure the time between the 1st and 3rd.
If I use maxevents=2. Then the other event will be in a separate group which needs to be discarded somehow.