topic Re: Finding duration, average time, maximum time for specific logs in Splunk Search

Finding duration, average time, maximum time for specific logs

pushpender07 — Fri, 20 Apr 2018 04:48:43 GMT

The logging that we do is not perfect hence need some help.

Log 1 (request) - {"date":"19-04-2018 21:40:11,221", "transactionId":"123", "className":"Class1", "methodName":"login", "elapsedTime":"2284896391"}
Log 2 (response)- {"date":"19-04-2018 21:40:11,253", "transactionId":"123", "className":"Class1", "methodName":"login", "elapsedTime":"2317835633"}

Log 1 is the request, Log 2 is the response. I want to find the duration of each login service request/ response. Transaction id is same in both cases so could be used as a unique value. Not sure what elapsedTime represents.

Any help would be highly appreciated.

Re: Finding duration, average time, maximum time for specific logs

p_gurav — Fri, 20 Apr 2018 05:06:50 GMT

Try something like:

| transaction transactionId

it will create duration field.

Re: Finding duration, average time, maximum time for specific logs

HeinzWaescher — Tue, 29 Sep 2020 19:05:20 GMT

Try this:

| eval date=strptime(date,"%d-%m-%Y %H:%M:%S,%3N")
| stats min(date) AS start, max(date) AS max_date BY transactionId
| eval duration=max_date-min_date

Re: Finding duration, average time, maximum time for specific logs

pushpender07 — Fri, 20 Apr 2018 16:14:52 GMT

Thanks, this helped

Re: Finding duration, average time, maximum time for specific logs

pushpender07 — Fri, 20 Apr 2018 16:16:33 GMT

This created transactionId, start, and max_date. It doesn't show the duration though. This is helpful though, I will try to take it from here.

Re: Finding duration, average time, maximum time for specific logs

woodcock — Sun, 22 Apr 2018 21:01:44 GMT

Like this:

Your Base Search | stats range(_time) AS duration BY transactionId

Re: Finding duration, average time, maximum time for specific logs

pushpender07 — Mon, 23 Apr 2018 22:17:18 GMT

Thanks for the help

Re: Finding duration, average time, maximum time for specific logs

woodcock — Tue, 24 Apr 2018 00:08:42 GMT