How do you calculate response time for events by field?

[rohinisb91]

Hi,

I have logs in the following format:

2018-10-31 16:00:00 START : run() for ruleId=xyz
2018-10-31 16:00:57 END : run() for ruleId=xyx

I want to plot a chart indicating the response times by ruleId. Any help is appreciated.

[renjith_nair · Accepted solution]

@rohinisb91 ,
Try

index="your search" "START" OR "END"|stats range(_time) as difference by ruleId

[rohinisb91]

Thank you!