Timediffrence between two different events

[venksplunk1]

Hi All,

I have two different search criteria & query. First search criteria/query will produce the start time for event 1 and second search criteria/query will be provide End time for event1. Need to calculate the duration between Start and End time using Splunk.

[venksplunk1]

Time Stamp Format for Start and End Time as follows: 2021-08-24T04:31:32.245+00:00

[isoutamo]

Hi

for individual event you can try this one:

index=XX cf_org_name=YY event_type=LogMessage cf_app_name="*-Envtname*" 
| spath "msg.message" 
| search "msg.message"="*ProductID*" 
| spath "msg.message" 
| search "msg.message"!="*ACTIVITY.LOG.IMPORTS*" 
| spath "msg.level" 
| spath cf_app_name 
| search cf_app_name="*Servicename*" 
| spath "msg.message" 
| search "msg.message"="*Request Initiated*" OR "msg.message"="*Request Fulfilled*"
| rename msg.@timestamp as EventStartTime,  msg.@timestamp as EventEndTIme
| eval sTime = strptime(EventStartTime, "%Y-%m-%dT%H:%M:%S.%3Q%:z"), eTime = strptime(EventEndTime, "%Y-%m-%dT%H:%M:%S.%3Q%:z")
| eval dTime = eTime - sTime, duration = tostring(dTime, "duration")
| table cf_app_name, EventStartTime, EventEndTime, duration, msg.message

For several events it could be better to use streamstats etc?

r. Ismo 

[venksplunk1]

Thanks for your reply.

My First query as follows: It will capture the EventStartTime

index=XX cf_org_name=YY event_type=LogMessage cf_app_name="*-Envtname*" | spath "msg.message" | search "msg.message"="*ProductID*" | spath "msg.message" | search "msg.message"!="*ACTIVITY.LOG.IMPORTS*" | spath "msg.level" | spath cf_app_name | search cf_app_name="*Servicename*" | spath "msg.message" | search "msg.message"="*Request Initiated*"  rename msg.@timestamp as EventStartTime |table cf_app_name,   EventStartTime, msg.message

My Second query as follows: It will capture the EventEndTime

index=XX cf_org_name=YY event_type=LogMessage cf_app_name="*-Envtname*" | spath "msg.message" | search "msg.message"="*ProductID*" | spath "msg.message" | search "msg.message"!="*ACTIVITY.LOG.IMPORTS*" | spath "msg.level" | spath cf_app_name | search cf_app_name="*Servicename*" | spath "msg.message" | search "msg.message"="*Request Fulfilled*"  rename msg.@timestamp as EventEndTIme |table cf_app_name,   EventEndTime, msg.message

As of now, I have executed my first and second queries sequentially and able to capture the start and end time. Need to capture the Start and End time in parallel and measure the difference between Start and End time. Duration=EventEndTime-EventStartTIme.

Would it be possible to help me here? Let me know if you are need of any additional details.

[isoutamo]

Hi

there are some different ways to do this based on your data. Can you give a sample data to us, so we could easier show the possibilities for your case?

There is already quite many answers for this questions on community, so you could try to found those also.

r. Ismo