How to calculate the difference between timestamps?

[skoelpin]

I have a lot of SOAP request/response pairs indexed in Splunk. One of those are CalculateTaxRequest and CalculateTaxResponse. So when the call is made it will show 23:59:04,108 and 23:59:04,437 respectfully (hour/minute/second/millisecond). I have created a new field called TimeStamp which extracts the time for each call. I then wrote a search for ...|transaction maxevents=2 and assigned another field (GUID) which matches the unique identifiers for the request/response in one field.

My current query is:

index=all  GUID="*" AND *calculatetax*   Timestamp="*" | transaction maxevents=2 

This search returns the request and response for calculatetax in the same field along with returning the timestamp for both fields. So now I would like to take those 2 timestamps and subtract them and have another field output the difference between the two in the same field. I'm doing this so I don't have to manually calculate the difference and see which services too longer then the others. Thanks in advance!

[wpreston]

Transaction automatically creates a field called duration that is the difference between the earliest and latest events in the transaction. If your Timestamp field is the same as the _time field in each event, the work is already done for you.

Just a side note, I'd recommend beefing up your transaction definition so that you can ensure the events that are paired together actually go together. By default, transaction combines events based on time, so if you have two CalculateTaxRequests start one after another, they could be combined into a transaction and your statistics would be off. Perhaps a transaction definition like this?

index=all  GUID="*" AND *calculatetax*   Timestamp="*" | transaction GUID startswith=CalculateTaxRequests endswith=CalculateTaxResponse  maxevents=2