Merge two events. One event has Request which server received and other event has response time.

[Shashank_87]

I have set of events which can be distinguished based on the ID. So basically a event with this ID where we get the requested content and another event with same ID where we get the response time and status code.
I want to calculate the response time for each page requested. Something like a table which contains two columns -
1. requested content
2. it's response time.
Please if someone can help me do that. I have written the below search to retrieve the ID -

index=index=* source="/request.log"| rex field=_raw "\[(?<ID>[^\]]+)" 

[DalJeanis · Accepted solution]

We've marked your code and put back the <ID> that was dropped by the interface.

Assuming that we've corrected your code correctly, then something like this should work. Put the list of fields that you want to keep from either kind of event, and this code should get you your result.

 index=index=* source="/request.log"
| fields  ... list the fields that you want to keep from any event...
| rex field=_raw "\[(?<ID>[^\]]+)" 
| stats values(*) as * by ID

The above code assumes that there will only ever be one of each kind of event. If there may be more, then there are a couple of other patterns to use.

[javiergn]

Related: https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-jo...