Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Find Time between events, including current Time.

$
0
0
Hello all, I've seen examples of how to find time between events using streamstats, and also to find the time since the most recent event using stats, but how would I accomplish doing both? Ultimately I'm trying to detect a loss of information that's reported every 10 minutes, so I'm using streamstats to search for differences of > 10 min, however this "outage" isn't detected until after the data is reported again, thus giving streamstats two items to actually compare. I need all of these deltas, and also the time since the most recent as occurred. Thanks, and here's some code I have: search | streamstats current=t last(_time) as last_time by field | eval outage= last_time - _time | eval outage=tostring(outage, "duration") | table field _time outage

Viewing all articles
Browse latest Browse all 47296

Trending Articles


Practice Sheet of Right form of verbs for HSC Students


Sarah Samis, Emil Bove III


ZARIA CUMMINGS


Need radio code for IVECO Delphi Aptiv FJ5 RBT M16


Black Angus Grilled Artichokes


Ed Sheeran – Sapphire – Pre-Single [iTunes Plus M4A]


Sunny Garcia’s Ex-Wife Colleen McCullough


99 God Status for Whatsapp, Facebook


Funeral of Sir Warwick Franklin


MHDD



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>