Splunk Enterprise

How to calculate time difference between two events?

vineela
Path Finder

 I have two events with start and end process and i need to calculate the time difference between the start process and end process of id but the fields are not configured, 
The data is like below:
Start process:
{"log":"[16:43:39.451] [INFO ] [] [c.c.n.m.a.n.a.b.i.DefaultNotificationAuthService] [] - Creating notification auth flow for idempotencyKey 8532923_default as entityId Qb4RmEiaR6-zp8FU8MsyQQ \n","stream":"stdout","docker":{"container_id":"cd1c24ba236b3aca14151619a174176957213d860408addfb964e6bd3ec04b81"},"kubernetes":{"container_name":"mms-au","namespace_name":"msaas-t5","pod_name":"mms-au-b-1-685f9fd75d-4bz87","container_image":"pso.docker.internal.cba/mms-au:2.3.1-0-1-5634ab725",}

End process :
{"log":"[16:43:39.876] [INFO ] [] [c.c.n.m.a.n.s.j.NotificationJMSProducer] [akka://MmsAuCluster/system/sharding/notificationAuthBpmn/5/Qb4RmEiaR6-zp8FU8MsyQQ_5/Qb4RmEiaR6-zp8FU8MsyQQ] - Submitting Enriched Notification for id 8532923 \n","stream":"stdout","docker":{"container_id":"cd1c24ba236b3aca14151619a174176957213d860408addfb964e6bd3ec04b81"},"kubernetes":{"container_name":"mms-au","namespace_name":"msaas-t5","pod_name":"mms-au-b-1-685f9fd75d-4bz87","container_image":"pso.docker.internal.cba/mms-au:2.3.1-0-1-5634ab725",

Need to calculate time difference between the above 2 events called "Creating notification auth flow " and "Submitting Enriched Notification".
Is this possible to do in splunk and if possible,how can we achieve it?
Thanks in Advance

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

There are a number of ways to do this - does this way work for you?

| rex "(Creating notification auth flow for idempotencyKey|Submitting Enriched Notification for id)\s(?<key>\d+)"
| stats range(_time) as timediff by key

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

There are a number of ways to do this - does this way work for you?

| rex "(Creating notification auth flow for idempotencyKey|Submitting Enriched Notification for id)\s(?<key>\d+)"
| stats range(_time) as timediff by key
0 Karma

vineela
Path Finder

Hi Whiser,
       Thanks a lot...It is working for me

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...