Getting Data In

Duration between messages

wscott12
New Member

Hi, I have messages in Splunk like:

{ [-] 
id: ABC
message: test1
timestamp: 2017-08-07T16:38:38+00:00 }
{ [-] 
id: BAC
message: test2 
source: client 
timestamp: 2017-08-07T16:38:38+00:00 }

These messages show up for each id. I would like to get duration between the first message "test" showing up and the second message "test2" by id. Maybe get the average duration for both messages showing up after tying each message to an id.

So basically, how can I get the average duration per ID How can I do that in Splunk?

For duplicate ids, I need to get the worst duration for that ID. So no duplicates. Thanks!

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Both of the answers assume that hte guid was supposed to be the same between the two messages. Is that accurate? If so, please edit the question to make those the same. If not, please edit to indicate how the programmer is going to determine that those two messages are in any way related to each other.

Thanks!

0 Karma

wscott12
New Member

I updated the question please check

0 Karma

woodcock
Esteemed Legend

Like this:

... | stats range(_time) AS gap BY guid
| stats avg(gap)

richgalloway
SplunkTrust
SplunkTrust

One approach, although not the fastest, is to use transaction. This command automatically computes the time difference between the starting and ending events and stores the result in a field called 'duration'. You can then calculate an average of that field.

... | transaction guid startswith="analyticsLoaded" endswith="doneWithAnalytics" | stats avg(duration) as AvgDuration by guid
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...