Splunk Enterprise

How to calculate time difference between two events?

vineela
Path Finder

 I have two events with start and end process and i need to calculate the time difference between the start process and end process of id but the fields are not configured, 
The data is like below:
Start process:
{"log":"[16:43:39.451] [INFO ] [] [c.c.n.m.a.n.a.b.i.DefaultNotificationAuthService] [] - Creating notification auth flow for idempotencyKey 8532923_default as entityId Qb4RmEiaR6-zp8FU8MsyQQ \n","stream":"stdout","docker":{"container_id":"cd1c24ba236b3aca14151619a174176957213d860408addfb964e6bd3ec04b81"},"kubernetes":{"container_name":"mms-au","namespace_name":"msaas-t5","pod_name":"mms-au-b-1-685f9fd75d-4bz87","container_image":"pso.docker.internal.cba/mms-au:2.3.1-0-1-5634ab725",}

End process :
{"log":"[16:43:39.876] [INFO ] [] [c.c.n.m.a.n.s.j.NotificationJMSProducer] [akka://MmsAuCluster/system/sharding/notificationAuthBpmn/5/Qb4RmEiaR6-zp8FU8MsyQQ_5/Qb4RmEiaR6-zp8FU8MsyQQ] - Submitting Enriched Notification for id 8532923 \n","stream":"stdout","docker":{"container_id":"cd1c24ba236b3aca14151619a174176957213d860408addfb964e6bd3ec04b81"},"kubernetes":{"container_name":"mms-au","namespace_name":"msaas-t5","pod_name":"mms-au-b-1-685f9fd75d-4bz87","container_image":"pso.docker.internal.cba/mms-au:2.3.1-0-1-5634ab725",

Need to calculate time difference between the above 2 events called "Creating notification auth flow " and "Submitting Enriched Notification".
Is this possible to do in splunk and if possible,how can we achieve it?
Thanks in Advance

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

There are a number of ways to do this - does this way work for you?

| rex "(Creating notification auth flow for idempotencyKey|Submitting Enriched Notification for id)\s(?<key>\d+)"
| stats range(_time) as timediff by key

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

There are a number of ways to do this - does this way work for you?

| rex "(Creating notification auth flow for idempotencyKey|Submitting Enriched Notification for id)\s(?<key>\d+)"
| stats range(_time) as timediff by key
0 Karma

vineela
Path Finder

Hi Whiser,
       Thanks a lot...It is working for me

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...