topic Re: how to calculate time difference between multiple events based on ID in Splunk Search

how to calculate time difference between multiple events based on ID

rkishoreqa — Thu, 15 Oct 2020 20:32:18 GMT

I have one requirement to calculate the time difference between multiple events based on JobId. The logs are like below. From the below logs I need to fetch time stamps for each jobId which having multiple events.
And calculate the difference between the timestamps and assign to the jobId like : bw0a10db49 - (2 mins)

2020-10-14 12:41:40.468 INFO [Process Worker-9]Log - 2020-10-14T12:41:40.468-04:00 - INFO - jobId: bw0a10db49;
Msg: Application testing.application started
2020-10-14 12:41:41.362 INFO [Process Worker-9]Log - 2020-10-14T12:41:40.468-04:00 - INFO - jobId: bw0a10db49;
Msg: Application testing.application started
2020-10-14 12:41:42.480 INFO [Process Worker-6]Log - 2020-10-14T12:41:42.48-04:00 - INFO - jobId: bw0a10db49;
Msg: EndOfFile Submited to ConcurentWebservice

Please suggest me with the query.

Thanks in advance.

Re: how to calculate time difference between multiple events based on ID

ITWhisperer — Thu, 15 Oct 2020 20:53:45 GMT

| stats earliest(_time) as start latest(_time) as end by jobid | eval diff=end-start

Re: how to calculate time difference between multiple events based on ID

rkishoreqa — Fri, 16 Oct 2020 17:53:48 GMT

I prepared the below as you suggested, it is working fine.

> index=tibco_44_bw6_dev | rex field=_raw "jobId: (?<jId>\w+);" | stats earliest(_time) as start latest(_time) as end by jId | eval diff=end-start |where diff >1000

I got the below results and difference is 3619, how can convert it to minutes.

image.png

Re: how to calculate time difference between multiple events based on ID

ITWhisperer — Sat, 17 Oct 2020 08:15:46 GMT

| fieldformat diff=tostring(diff,"duration")