All Apps and Add-ons

Repeating Event time difference

axl88
Communicator

10/18/2013 1:49:51 Message: IP Address : xxxx Message2: Message1 (first process starts)
10/18/2013 1:49:51 Message: Other_Message2
10/18/2013 1:50:52 Message: Other Message3
10/18/2013 1:50:52 Message: Other Message4
10/18/2013 1:51:51 Message: Other_Message2
10/18/2013 1:52:52 Message: Other Message31
10/18/2013 1:53:52 Message: Other Message22
10/18/2013 1:54:52 Message: Other Message2
10/18/2013 1:55:53 Message: Other Message2 (end of the 1st process)
10/18/2013 2:55:51 Message: IP Address : xxxx Message2: Message1 (Second Event Starts)

My app log file looks like that. I need to get the time value between the first message and last message which is same as first one except timestamp it shows. I can't use Transaction method as you can see Message2 occurs several times between those two events. Any ideas for the solution? I m a newbie splunker, I m appreciated for the any comments.

0 Karma
1 Solution

somesoni2
Revered Legend

Try this.

your base search | rex "(?i)^(?:[^ ]* ){2}(?P<raw_data>.+)" | transaction raw_data

you can add filters in your base search to just select first and last event (from the example).

View solution in original post

Runals
Motivator

You could potentially rex the IP address and then use transaction on that.

0 Karma

somesoni2
Revered Legend

Try this.

your base search | rex "(?i)^(?:[^ ]* ){2}(?P<raw_data>.+)" | transaction raw_data

you can add filters in your base search to just select first and last event (from the example).

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You could extract the to-be-identical message into a field, and do this:

... | stats range(_time) as duration by message_field

martin_mueller
SplunkTrust
SplunkTrust

Then you're looking for transaction. That allows you to specify spans of and pauses between transactions.

0 Karma

axl88
Communicator

approach is nice, but this time interval will occur maybe 100 times in the log. I m trying to get some data like lets say, daily average of time it was spend.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!