topic Need to Calculate Response Time matching Index ID between 2 lines in the search in Splunk Search

Need to Calculate Response Time matching Index ID between 2 lines in the search

lsanthoshbe — Wed, 30 Sep 2020 00:29:15 GMT

If look the below screen shot due to multiple calls in same time some time response takes a while and we need to match the ID and calculate difference
right now i am using the below query this works well if we have request and response comes next to each other

index=e1prd host=pite1bspd1 sourcetype=e1_npd_bssv PublishedMethod | transaction transid startswith="startPublishedMethod" endswith="finishPublishedMethod" | rename duration as Response_Time |table Instance_ID,Response_Time

Please advise
Thanks,
Santhosh

Re: Need to Calculate Response Time matching Index ID between 2 lines in the search

macadminrohit — Sat, 11 May 2019 00:09:05 GMT

you can first try to convert your time to epoch using strptime and then use streamstats to group together both the events with the same id and then calculate the difference.

Re: Need to Calculate Response Time matching Index ID between 2 lines in the search

lsanthoshbe — Sat, 11 May 2019 00:34:27 GMT

if you can provide exact query / sample that would be great !!
Thanks for your help

Re: Need to Calculate Response Time matching Index ID between 2 lines in the search

woodcock — Sat, 11 May 2019 05:03:05 GMT

Try this:

index=e1prd host=pite1bspd1 sourcetype=e1_npd_bssv *PublishedMethod*
| streamstats count(eval(searchmatch("finishPublishedMethod"))) AS sessionID BY instance_ID transid
| stats range(_time) AS Response_Time BY sessionID instance_ID transid

Re: Need to Calculate Response Time matching Index ID between 2 lines in the search

lsanthoshbe — Sat, 11 May 2019 14:05:46 GMT

Excellent Gregg!! Thanks for you support !! i used this below query and looks like working now
i really appreciate your support

index=e1stg host=pite1bsqa2  *PublishedMethod*
| streamstats count(eval(searchmatch("finishPublishedMethod"))) AS sessionID BY Instance_ID_QA
| stats range(_time) AS Response_Time BY sessionID Instance_ID_QA
| table Instance_ID_QA,Response_Time