Deployment Architecture

search PID and list according to PID generated and killed time

vijen2000
Explorer

Hello Splunk Community,

I am kind of beginner in Splunk. Need help on a scenario

I have below example logs

 

2020-08-20 08:52:46, 760 XYZ_Processor/1.1.0 Application Process Completed

2020-08-20 08:51:46, 760 XYZ_Processor/1.1.0 Random logs

2020-08-20 08:50:46, 760 XYZ_Processor/1.1.0 Random logs

2020-08-20 08:47:46, 760 XYZ_Processor/1.1.0 Application Process Id generated : 23232

2020-08-20 08:40:46, 760 XYZ_Processor/1.1.0 Application Process Completed

2020-08-20 08:39:46, 760 XYZ_Processor/1.1.0 Random logs

2020-08-20 08:38:46, 760 XYZ_Processor/1.1.0 Random logs

2020-08-20 08:37:46, 760 XYZ_Processor/1.1.0 Application Process Id generated : 42343

 

I want below results

PID                     START_TIME                          END_TIME                             TIME_TAKEN

42343        2020-08-20 08:37:46      2020-08-20 08:40:46                   03:00:00

23232        2020-08-20 08:47:46      2020-08-20 08:52:46                   05:00:00

 

Could anyone help in this? I have to add PID as first field from the logs and print in first column and then start time and end time of the process and then the time taken. Thank you in advance.

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
index=... ("Application Process Completed" OR "Application Process Id generated"
| rex "Application Process Id generated : (?<id>\d+)"
| streamstats window=2 earliest(_time) as start earliest(id) as pid
| where isnull(id)
| eval time_taken=_time-start
| table pid start _time time_taken
| fieldformat start=strftime(start,"%Y-%m-%d %H:%M:%S")
| fieldformat time_taken=strftime(time_taken,"%H:%M:%S")

View solution in original post

0 Karma

vijen2000
Explorer

@ITWhispererIt worked 😀

Thanks a lot buddy for swift response. Big thumps up to you 👍

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can more than one process run concurrently?

2020-08-20 08:52:46, 760 XYZ_Processor/1.1.0 Application Process Completed

2020-08-20 08:51:46, 760 XYZ_Processor/1.1.0 Random logs

2020-08-20 08:50:46, 760 XYZ_Processor/1.1.0 Random logs

2020-08-20 08:47:46, 760 XYZ_Processor/1.1.0 Application Process Completed

2020-08-20 08:40:46, 760 XYZ_Processor/1.1.0 Application Process Id generated : 23232

2020-08-20 08:39:46, 760 XYZ_Processor/1.1.0 Random logs

2020-08-20 08:38:46, 760 XYZ_Processor/1.1.0 Random logs

2020-08-20 08:37:46, 760 XYZ_Processor/1.1.0 Application Process Id generated : 42343

If so, how do you identify which Process ID each Application Process Completed is related to?

vijen2000
Explorer

@ITWhisperer

Thanks for response. Only one process run at a time.

Once process completes, we get the message "Application Process Completed" and then new id get created again like this

2020-08-20 08:40:46, 760 XYZ_Processor/1.1.0 Application Process Id generated : 23232

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=... ("Application Process Completed" OR "Application Process Id generated"
| rex "Application Process Id generated : (?<id>\d+)"
| streamstats window=2 earliest(_time) as start earliest(id) as pid
| where isnull(id)
| eval time_taken=_time-start
| table pid start _time time_taken
| fieldformat start=strftime(start,"%Y-%m-%d %H:%M:%S")
| fieldformat time_taken=strftime(time_taken,"%H:%M:%S")
0 Karma
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...