Repeating Event time difference

[axl88]

10/18/2013 1:49:51 Message: IP Address : xxxx Message2: Message1 (first process starts)
10/18/2013 1:49:51 Message: Other_Message2
10/18/2013 1:50:52 Message: Other Message3
10/18/2013 1:50:52 Message: Other Message4
10/18/2013 1:51:51 Message: Other_Message2
10/18/2013 1:52:52 Message: Other Message31
10/18/2013 1:53:52 Message: Other Message22
10/18/2013 1:54:52 Message: Other Message2
10/18/2013 1:55:53 Message: Other Message2 (end of the 1st process)
10/18/2013 2:55:51 Message: IP Address : xxxx Message2: Message1 (Second Event Starts)

My app log file looks like that. I need to get the time value between the first message and last message which is same as first one except timestamp it shows. I can't use Transaction method as you can see Message2 occurs several times between those two events. Any ideas for the solution? I m a newbie splunker, I m appreciated for the any comments.

[Runals]

You could potentially rex the IP address and then use transaction on that.

[somesoni2 · Accepted solution]

Try this.

your base search | rex "(?i)^(?:[^ ]* ){2}(?P<raw_data>.+)" | transaction raw_data

you can add filters in your base search to just select first and last event (from the example).

[martin_mueller]

You could extract the to-be-identical message into a field, and do this:

... | stats range(_time) as duration by message_field

[martin_mueller]

Then you're looking for transaction. That allows you to specify spans of and pauses between transactions.

[axl88]

approach is nice, but this time interval will occur maybe 100 times in the log. I m trying to get some data like lets say, daily average of time it was spend.