topic Re: Time difference between 2 events in Other Usage

Time difference between 2 events

manas — Wed, 24 Jan 2024 20:28:31 GMT

I have 2 events :

Event 1 :

Timestamp A UserID:ABC startevent

Event 2:

Timestamp B ID:ABC endevent

I want to find time difference between start event and end event . In first event field is named "UserID" and in second event field is named "ID" .These two fields holds the value of the user for which start and subsequent end event is generated.

How can i get time difference here ? To use transaction i need a shared field .When i use transaction like below:

| transaction userId startswith=(event="startevent") endswith=("endevent") maxevents=2 , i get very few results .

Re: Time difference between 2 events

richgalloway — Wed, 24 Jan 2024 21:11:08 GMT

You have a common field, just not a common name. That's easy to fix using the coalesce function.

index=foo (UserID=* OR ID=*) | eval commonID=coalesce(UserID, ID) | stats min(_time) as startTime, max(_time) as endTime, values(*) as * by commonID | eval diff=endTime - startTime

Re: Time difference between 2 events

manas — Thu, 25 Jan 2024 17:00:30 GMT

Thanks .Used coalesce and transaction to get the data.