All Apps and Add-ons

Repeating Event time difference

axl88
Communicator

10/18/2013 1:49:51 Message: IP Address : xxxx Message2: Message1 (first process starts)
10/18/2013 1:49:51 Message: Other_Message2
10/18/2013 1:50:52 Message: Other Message3
10/18/2013 1:50:52 Message: Other Message4
10/18/2013 1:51:51 Message: Other_Message2
10/18/2013 1:52:52 Message: Other Message31
10/18/2013 1:53:52 Message: Other Message22
10/18/2013 1:54:52 Message: Other Message2
10/18/2013 1:55:53 Message: Other Message2 (end of the 1st process)
10/18/2013 2:55:51 Message: IP Address : xxxx Message2: Message1 (Second Event Starts)

My app log file looks like that. I need to get the time value between the first message and last message which is same as first one except timestamp it shows. I can't use Transaction method as you can see Message2 occurs several times between those two events. Any ideas for the solution? I m a newbie splunker, I m appreciated for the any comments.

0 Karma
1 Solution

somesoni2
Revered Legend

Try this.

your base search | rex "(?i)^(?:[^ ]* ){2}(?P<raw_data>.+)" | transaction raw_data

you can add filters in your base search to just select first and last event (from the example).

View solution in original post

Runals
Motivator

You could potentially rex the IP address and then use transaction on that.

0 Karma

somesoni2
Revered Legend

Try this.

your base search | rex "(?i)^(?:[^ ]* ){2}(?P<raw_data>.+)" | transaction raw_data

you can add filters in your base search to just select first and last event (from the example).

martin_mueller
SplunkTrust
SplunkTrust

You could extract the to-be-identical message into a field, and do this:

... | stats range(_time) as duration by message_field

martin_mueller
SplunkTrust
SplunkTrust

Then you're looking for transaction. That allows you to specify spans of and pauses between transactions.

0 Karma

axl88
Communicator

approach is nice, but this time interval will occur maybe 100 times in the log. I m trying to get some data like lets say, daily average of time it was spend.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...