My application always relies on backend service which we are using SOAP. Every successful SOAP call will always have 2 events — request and response. Both events will have one similar field with the same value which is technical id and this is unique to each call.
Request:
2018-12-18 10:46:03,987 {uid=aaa@bb.com, techid=1074979098911391744, sid=9999} - Outbound Message - BackendOne
Response:
2018-12-18 10:46:04,549 {uid=aaa@bb.com, techid=1074979098911391744, sid=9999} - Inbound Message - BackendOne
So based on these results, I'm supposed to extract duration required by each backend services which took more than 1000 ms to complete.
@farhanzakaria,
There are few different ways to get this.
"your search" |stats count,earliest(_time) as start,latest(_time) as end by techid|eval duration=end-start|where duration >1 AND count>1
Using Transaction
"your search"|transaction techid startswith="Outbound Message" endswith="Inbound Message"|where duration>1
@farhanzakaria,
There are few different ways to get this.
"your search" |stats count,earliest(_time) as start,latest(_time) as end by techid|eval duration=end-start|where duration >1 AND count>1
Using Transaction
"your search"|transaction techid startswith="Outbound Message" endswith="Inbound Message"|where duration>1
Thank you! The first answer would be the best as transaction would be really costly for my instance.