Time different between two log records

[saifdj]

We are using Splunk logs in an iOS app, We are logging
1. Request Log (has URL, Tag, appTimestamp fields in log)
2. Response details (failed / succeeded, has response JSON, Tag, appTimestamp fields in log)

The Tag is unique for each request, we want to identify the time difference between request and response logs, (difference between 1 and 2 logs).

Sample Request Log:
"businessFlowTag":"Login - Get REP JWT token" ,"appTimestamp":"Apr 30, 2020, 04:08:21.103 GMT", "note" : "URL_OF_API"

Sample Response Log:
"businessFlowTag":"Login - Get REP JWT token" ,"appTimestamp":"Apr 30, 2020, 04:08:24.100 GMT", "note" : "RESPONSE_JSON_OF_API"

In above case there is a time difference of 3 seconds between request and response.
(Apr 30, 2020, 04:08:24.100 GMT) - (Apr 30, 2020, 04:08:21.103 GMT) = 3 seconds

I want this time difference for each request. please help

please let me know if any additional details requred

[richgalloway]

You should be able to do it using stats.

... | eval epoch = strptime(appTimestamp, "%b %d, %Y, %H:%M:%S.%3N %z")
| stats earliest(epoch) as start, latest(epoch) as end by tag
| eval diff = end - start
| ...