https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-for-my-sample-data/m-p/280893#M84781 <P>Give this a try (assuming CorrelationID is the primary key. If there are additional fields that differentiate uniq transaction, add them to stats)</P> <PRE><CODE>your base search | fields _time CorrelationID DCN TransactionTimestamp GroupNumber ServiceLineCount SectionNumber CorporateEntityCode ClaimType VendorName VendorCode TransactionCode OutCome Message_Text UtilizationAmount | eval ReqTime=if(TransactionCode="REQ",_time,null()) | eval AckTime=if(TransactionCode="Ack",_time,null()) | eval RespTime=if(TransactionCode="Response",_time,null()) | stats values(*) as * by CorrelationID | eval DurationReq_Ack=AckTime-ReqTime | eval DurationAck_Resp = RespTime-AckTime </CODE></PRE> Tue, 07 Feb 2017 16:57:21 GMT somesoni2 2017-02-07T16:57:21Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-for-my-sample-data/m-p/280892#M84780 <P>i have logs like this for each req.....</P> <PRE><CODE>2016-11-09 12:57:18,855 CorrelationID=2469bae9-fe14-4e67-b345-95d652f4a868, DCN =02016047501V1370X, TransactionTimestamp =1478717835696 , GroupNumber =000142003, ServiceLinecount=xx, SectionNumber =0001, CorporateEntityCode =TX1, ClaimType=0, VendorName =XXX, VendorCode=xxx, TransactionCode=REQ 2016-11-09 12:57:18,855 CorrelationID=2469bae9-fe14-4e67-b345-95d652f4a868, DCN =02016047501V1370X, TransactionTimestamp =1478717835696, GroupNumber =000142003, ServiceLineCount=xxx, SectionNumber =0001, CorporateEntityCode =TX1, ClaimType=0, VendorName =XXX, VendorCode=xxx, TransactionCode=Ack, OutCome= Success , Message text=xxxx 2016-11-09 12:57:18,855 CorrelationID=2469bae9-fe14-4e67-b345-95d652f4a868, DCN =02016047501V1370X, TransactionTimestamp =1478717835696, GroupNumber =000142003, ServiceLineCount=xxx, SectionNumber =0001, CorporateEntityCode =TX1, ClaimType=0, VendorName =XXX, VendorCode=xx, TransactionCode=Response ,UtilizationAmount=xxx. </CODE></PRE> <P>In each message up to vendor code everything is similar ..<BR /> i need a table with all the details information along with how much time it has taken between req,ACK and ACK,RSP in single table...so that later on i want to build the summary index with those search.....<BR /> is anyone help in this could appreciate that...!! thanks in advance...</P> Tue, 07 Feb 2017 16:40:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-for-my-sample-data/m-p/280892#M84780 prashanthberam 2017-02-07T16:40:20Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-for-my-sample-data/m-p/280893#M84781 <P>Give this a try (assuming CorrelationID is the primary key. If there are additional fields that differentiate uniq transaction, add them to stats)</P> <PRE><CODE>your base search | fields _time CorrelationID DCN TransactionTimestamp GroupNumber ServiceLineCount SectionNumber CorporateEntityCode ClaimType VendorName VendorCode TransactionCode OutCome Message_Text UtilizationAmount | eval ReqTime=if(TransactionCode="REQ",_time,null()) | eval AckTime=if(TransactionCode="Ack",_time,null()) | eval RespTime=if(TransactionCode="Response",_time,null()) | stats values(*) as * by CorrelationID | eval DurationReq_Ack=AckTime-ReqTime | eval DurationAck_Resp = RespTime-AckTime </CODE></PRE> Tue, 07 Feb 2017 16:57:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-for-my-sample-data/m-p/280893#M84781 somesoni2 2017-02-07T16:57:21Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-for-my-sample-data/m-p/280894#M84782 <P>thanks...it's working...can i make it as a summary report....</P> Tue, 07 Feb 2017 19:03:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-for-my-sample-data/m-p/280894#M84782 prashanthberam 2017-02-07T19:03:37Z