How do I group 2 events based on a unique field and extract time of the duration between them?

[farhanzakaria]

My application always relies on backend service which we are using SOAP. Every successful SOAP call will always have 2 events — request and response. Both events will have one similar field with the same value which is technical id and this is unique to each call.

Request:

2018-12-18 10:46:03,987 {uid=aaa@bb.com, techid=1074979098911391744, sid=9999} - Outbound Message - BackendOne

Response:
2018-12-18 10:46:04,549 {uid=aaa@bb.com, techid=1074979098911391744, sid=9999} - Inbound Message - BackendOne

So based on these results, I'm supposed to extract duration required by each backend services which took more than 1000 ms to complete.

[renjith_nair · Accepted solution]

@farhanzakaria,

There are few different ways to get this.

"your search" |stats count,earliest(_time) as start,latest(_time) as end by techid|eval duration=end-start|where duration >1 AND count>1

Using Transaction

    "your search"|transaction techid startswith="Outbound Message" endswith="Inbound Message"|where duration>1

[farhanzakaria]

Thank you! The first answer would be the best as transaction would be really costly for my instance.