Finding the _time difference between two subsearches

Question

I'm unable to get this search to output anything except the _time of the first search:

anyway it's a logfile that timestamps when the backgroundworker sub starts a routine followed by another entry where it ENDs. It happens multiple times per source so dedup being used in this way probably isn't the best idea. There are many difference sources being indexed each with a unique name. Is this the way to do this? Thanks in advance.

Accepted Answer

2

index=collect host=app* "backgroundWorkLoad Completed" 
| stats range(_time) as duration earliest(_time) as time_one latest(_time) as time_two by source

will probably get you the right results efficiently. Otherwise:

index=collect host=app* "backgroundWorkLoad Completed"
| eval time_one=if(match(_raw, "backgroundWorkerLoad\w+Completed(?!\sEND)"),_time,null()
| eval time_two=if(match(_raw, "backgroundWorkerLoad\w+Completed\sEND"),_time,null())
| stats earliest(time_one) as time_one latest(time_two) as time_two by source 
| eval duration=time_two-time_one

should get you the same as what you appear to intend.

link

answered 23 May '12, 17:09

gkanapathy ♦
32.3k●4●8●27
accept rate: 41%

The first search worked great, but the results scared me. Thanks for the help. I was definitely making it more complicated than I should have.

(25 May '12, 11:42) nelsonb

The one problem with doing the stat by source though is that it's only returning one result by source. Each source has several hundred occurences of these pairs of events happening. Is there some other way to sort the returns? I'm trying a few variations.

(25 May '12, 12:36) nelsonb

Okay, then you need to use the transaction command, which automatically calculates duration. Something like:

index=collect host=app* "backgroundWorkLoad Completed" | transaction source startswith=("backgroundWorkLoad Completed NOT END") endswith=("backgroundworkerload Completed END") maxevents=2 | table source duration

might work.

(25 May '12, 16:42) gkanapathy ♦

This returned all the results I was looking for. Thanks!

(29 May '12, 10:53) nelsonb

Finding the _time difference between two subsearches

Follow this question

Splunk Resources

Related questions