Archive

Need to Calculate Response Time matching Index ID between 2 lines in the search

New Member

alt text

If look the below screen shot due to multiple calls in same time some time response takes a while and we need to match the ID and calculate difference
right now i am using the below query this works well if we have request and response comes next to each other

index=e1prd host=pite1bspd1 sourcetype=e1_npd_bssv PublishedMethod | transaction transid startswith="startPublishedMethod" endswith="finishPublishedMethod" | rename duration as Response_Time |table Instance_ID,Response_Time

Please advise
Thanks,
Santhosh

Tags (1)
0 Karma
1 Solution

Esteemed Legend

Try this:

index=e1prd host=pite1bspd1 sourcetype=e1_npd_bssv *PublishedMethod*
| streamstats count(eval(searchmatch("finishPublishedMethod"))) AS sessionID BY instance_ID transid
| stats range(_time) AS Response_Time BY sessionID instance_ID transid

View solution in original post

0 Karma

Esteemed Legend

Try this:

index=e1prd host=pite1bspd1 sourcetype=e1_npd_bssv *PublishedMethod*
| streamstats count(eval(searchmatch("finishPublishedMethod"))) AS sessionID BY instance_ID transid
| stats range(_time) AS Response_Time BY sessionID instance_ID transid

View solution in original post

0 Karma

New Member

Excellent Gregg!! Thanks for you support !! i used this below query and looks like working now
i really appreciate your support

index=e1stg host=pite1bsqa2  *PublishedMethod*
| streamstats count(eval(searchmatch("finishPublishedMethod"))) AS sessionID BY Instance_ID_QA
| stats range(_time) AS Response_Time BY sessionID Instance_ID_QA
| table Instance_ID_QA,Response_Time
0 Karma

Contributor

you can first try to convert your time to epoch using strptime and then use streamstats to group together both the events with the same id and then calculate the difference.

0 Karma

New Member

if you can provide exact query / sample that would be great !!
Thanks for your help

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!