topic How to search the time difference between transactions? in Splunk Search

How to search the time difference between transactions?

ppatkar — Wed, 22 Jun 2016 14:34:06 GMT

I have three statements in my log file for each transaction like below:

index=abc*  source="abc.log" 2410286283_b310-3358a1229709 INFO  

22/Jun/2016 13:52:21.318 [ Thread-2 ] INFO : ResponsePoll    - [STEP_ID = checkStatus ]{ message = "Status from server" , messageId = 2410286283_b310-3358a1229709, ResponseStatus = SUCCESS }
22/Jun/2016 13:52:20.957 [ cacher-0 ] INFO : cacher    - Cached [AppResponse{messageId='2410286283_b310-3358a1229709',  responseSubscriberName='client01'}]
22/Jun/2016 13:52:05.191 [ sender-3 ] INFO : MessageService    - [RequestStatus=Sent, Request=SuperVO{sessionId='2410286283_b310-3358a1229709', responseSubscriberName='client01'}]

I need to calculate the time between the statements having keyword ResponseStatus = SUCCESS and RequestStatus=Sent for each of the ID's like 2410286283_b310-3358a1229709.
In the above case, I should get a result as:

2410286283_b310-3358a1229709   00:00:16:127

I would like to do this for various ID's in my logs through Splunk.
Due to different naming standards followed in request & response for the ID, I am unable to think of a way to do this.

Any insights or help appreciated.

Re: How to search the time difference between transactions?

sundareshr — Wed, 22 Jun 2016 18:48:54 GMT

Try this

index=abc* source="abc.log" ResponseStatus="SUCCESS" OR ResponseStatus="Sent" | eval sid=coalesce(sessionId, messageId) | streamstats window=1 current=f earliest(_time) as start by sid | eval duration=tostring(_time-start, "duration")

Re: How to search the time difference between transactions?

ppatkar — Thu, 23 Jun 2016 04:59:08 GMT

@sundareshr : Thanks for your help ! I slightly modified your answer & got it to work

index=abc* source="abc.log"  "ResponseStatus = SUCCESS" OR "RequestStatus=Sent"  | eval sid=coalesce(replace(sessionId,"'",""), messageId) |  stats range(_time) as duration by sid