Duration between messages

[wscott12]

Hi, I have messages in Splunk like:

{ [-] 
id: ABC
message: test1
timestamp: 2017-08-07T16:38:38+00:00 }
{ [-] 
id: BAC
message: test2 
source: client 
timestamp: 2017-08-07T16:38:38+00:00 }

These messages show up for each id. I would like to get duration between the first message "test" showing up and the second message "test2" by id. Maybe get the average duration for both messages showing up after tying each message to an id.

So basically, how can I get the average duration per ID How can I do that in Splunk?

For duplicate ids, I need to get the worst duration for that ID. So no duplicates. Thanks!

[DalJeanis]

Both of the answers assume that hte guid was supposed to be the same between the two messages. Is that accurate? If so, please edit the question to make those the same. If not, please edit to indicate how the programmer is going to determine that those two messages are in any way related to each other.

Thanks!

[wscott12]

I updated the question please check

[woodcock]

Like this:

... | stats range(_time) AS gap BY guid
| stats avg(gap)

[richgalloway]

One approach, although not the fastest, is to use transaction. This command automatically computes the time difference between the starting and ending events and stores the result in a field called 'duration'. You can then calculate an average of that field.

... | transaction guid startswith="analyticsLoaded" endswith="doneWithAnalytics" | stats avg(duration) as AvgDuration by guid