Find the Difference between Timestamps

skoelpin — Fri, 02 Jan 2015 15:31:00 GMT

In Splunk I'm tracking web service calls which have a request/response pairs. So for example we have a Get Delivery Schedule web service which has a SOAP request and response. We have a unique identifier (GUID) tied to the request response pairs which match each other. I want to find the time from when the request was made to the time there was a response. So I was thinking of making a new field which would take the difference between the response timestamp and the request time stamp and applying it to the request event. So then I could search for all the requests by using the GUID and have that response time tied to each request. I then wanted to grab all the response times and export it to Excel so I can do an analysis.

Any idea how I could do this?

Re: Find the Difference between Timestamps

chanfoli — Fri, 02 Jan 2015 18:47:21 GMT

Have a look at the transaction command. If your search returns requests and responses with an identifier, all you usually need to do is add something like "| transaction GUIDFIELDNAME"

Depending on things such as maximum expected request time and if request and response events have identifiers you could make it more reliable by using additional options like maxspan, startswith, and endswith.

This command will add some fields to your results, one of which is duration in seconds, and this sounds like what you are after.

See: http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/transaction

topic Find the Difference between Timestamps in Getting Data In

Find the Difference between Timestamps

Re: Find the Difference between Timestamps