My log file is like
02/04/2018 - 06:27:23 --- process 1 started
02/04/2018 - 06:28:23 --- process 1 completed
02/04/2018 - 06:28:23 --- backup initiated
02/04/2018 - 06:30:23 --- mail sent
02/04/2018 - 06:31:23 --- 'back up completed
I want to calculate time taken by " backup initiated" to "back up completed" with date. I want to generate a report for date and time taken by the process.
@shubhambhagat02
If you do not have a common field for each events to denote a start//finish, try using transaction
your searches | transaction startswith="backup initiated" endswith="back up completed" maxspan=10m
Above gives you a "duration". Maxspan should be changed according to your process durations
OR
If there are only two events in a day, then set the time rande to that day and
search "backup*"|stats earliest(_time) as backup_start_time,latest(_time) as backup_end_time|eval duration=backup_end_time-backup_start_time
@shubhambhagat02
If you do not have a common field for each events to denote a start//finish, try using transaction
your searches | transaction startswith="backup initiated" endswith="back up completed" maxspan=10m
Above gives you a "duration". Maxspan should be changed according to your process durations
OR
If there are only two events in a day, then set the time rande to that day and
search "backup*"|stats earliest(_time) as backup_start_time,latest(_time) as backup_end_time|eval duration=backup_end_time-backup_start_time