How to search the time difference between start and end events for each unique event ID?

[kflavin]

I have a log file going to Splunk which indicates the start and end of an event for VM creation. For example, in the logs I see something like this:

6/15/2015 11:00:00 <unique ID 1> Start event
... other events...
6/15/2015 11:02:00 <unique ID 1> End event
... other events...
6/15/2015 11:04:00 <unique ID 2> Start event
... other events...
6/15/2015 11:05:00 <unique ID 2> End event

I want to be able to get the time difference between the start and end event for all unique events as given by "unique id X".

Another way of saying it is, for all unique ID's, do eval(endtimestamp - starttimestamp), and print out the time difference in table form. I'm struggling to figure out how to do this through Splunk though. Can anyone point me in the right direction?

[woodcock · Accepted solution]

Like this (assuming you are already extracting Unique ID as UniqueID😞

... | stats earliest(_time) AS startTime latest(_time) AS endTime by UniqueID | eval DurationSeconds=(endTime - startTime)

[kflavin]

Thanks. I'm still trying to get the uniqueid extracted as a field, then I'll give it a try.

[woodcock]

Try something like this:

... | rex "^\d+/\d+/\d+\s+\d+:\d+:\d+\s+(?<UniqueID>\S+)" | stats earliest(_time) AS startTime latest(_time) AS endTime by UniqueID | eval DurationSeconds=(endTime - startTime)

[kflavin]

Working! Thanks for your help.