topic Duration between messages in Getting Data In

Duration between messages

wscott12 — Mon, 07 Aug 2017 16:46:58 GMT

Hi, I have messages in Splunk like:

{ [-] 
id: ABC
message: test1
timestamp: 2017-08-07T16:38:38+00:00 }
{ [-] 
id: BAC
message: test2 
source: client 
timestamp: 2017-08-07T16:38:38+00:00 }

These messages show up for each id. I would like to get duration between the first message "test" showing up and the second message "test2" by id. Maybe get the average duration for both messages showing up after tying each message to an id.

So basically, how can I get the average duration per ID How can I do that in Splunk?

For duplicate ids, I need to get the worst duration for that ID. So no duplicates. Thanks!

Re: Duration between messages

richgalloway — Mon, 07 Aug 2017 19:14:30 GMT

One approach, although not the fastest, is to use transaction. This command automatically computes the time difference between the starting and ending events and stores the result in a field called 'duration'. You can then calculate an average of that field.

... | transaction guid startswith="analyticsLoaded" endswith="doneWithAnalytics" | stats avg(duration) as AvgDuration by guid

Re: Duration between messages

woodcock — Tue, 08 Aug 2017 19:17:34 GMT

Like this:

... | stats range(_time) AS gap BY guid
| stats avg(gap)

Re: Duration between messages

wscott12 — Sat, 12 Aug 2017 06:16:39 GMT

I updated the question please check

Re: Duration between messages

DalJeanis — Sat, 12 Aug 2017 20:49:53 GMT

Both of the answers assume that hte guid was supposed to be the same between the two messages. Is that accurate? If so, please edit the question to make those the same. If not, please edit to indicate how the programmer is going to determine that those two messages are in any way related to each other.

Thanks!