topic Re: how to find tolerant match between two events. in Splunk Search

How to find tolerant match between two events?

avi7326 — Tue, 05 Jul 2022 17:10:06 GMT

I want to know how long will tolerant match takes to give the result between the event requested and the event response using any correlation Id. It should also calculate the average duration median duration.

Re: how to find tolerant match between two events.

ITWhisperer — Mon, 04 Jul 2022 14:59:55 GMT

How are you defining "tolerant match"?

Re: how to find tolerant match between two events.

avi7326 — Mon, 04 Jul 2022 15:05:53 GMT

tolerant match is that we have to check that the account is existing or we have to create a new one that is to be done by tolerant match and we have to monitor how long will it take to process the address

Re: how to find tolerant match between two events.

ITWhisperer — Mon, 04 Jul 2022 15:35:28 GMT

How do you determine if the account exists or not?

Re: how to find tolerant match between two events.

avi7326 — Mon, 04 Jul 2022 15:52:36 GMT

I have to calculate the time it takes between request to tolerant match log and response to tolerant match log

Re: how to find tolerant match between two events.

avi7326 — Tue, 05 Jul 2022 10:28:16 GMT

I have used this query for a particular time period but it is not showing any result and what if the day changes so this query will not work this is not scalable so what should I do.

| eval swipe=strptime($In Swipe$,'%d/%m/%y %H:%M:%S') | eval login=strptime(LoginTime,'%d/%m/%y %H:%M:%S') | eval diff = swipe-login | where diff > 0