Find Difference between multiple events

[rkmaggidi]

TransID AppName timestamp Messagge
1 App1 2019-12-16 18:18:43.731 +0000 Message……
1 App1 2019-12-16 18:18:43.732 +0000 Before call: 1
1 App2 2019-12-16 18:18:43.743 +0000 Message…..
1 App2 2019-12-16 18:18:43.745 +0000 Message…..
1 App1 2019-12-16 18:18:43.807 +0000 After Call: 1
1 App1 2019-12-16 18:18:43.809 +0000 Message………
2 App1 2019-12-16 18:22:37.720 +0000 Message……
2 App1 2019-12-16 18:22:37.724 +0000 Before call: 2
2 App2 2019-12-16 18:22:37.755 +0000 Message…..
2 App2 2019-12-16 18:22:37.760 +0000 Message…..
2 App1 2019-12-16 18:22:37.820 +0000 After Call: 2
2 App1 2019-12-16 18:22:37.822 +0000 Message………

I have data in above format and I want to get the output as a report which shows how much time each AppName takes to process a tarnsaction. in below format:

TransID App1 App2 ....
1 0.002 0.002 ....
2 0.006 0.005 ...

I tried using transaction command but it gives me the duration based on the first and last event. but In my case I need how much time a transaction was in a particular app?

Thanks.

[richgalloway · Accepted solution]

You should be able to do that with stats. First, convert the timestamp field into epoch form so the difference can be computed.

... | eval ts=strptime(timestamp, "%Y-%m-%d %H:%M:%S.%3N")
| stats range(ts) by TransID AppName

[rkmaggidi]

Thanks it worked 🙂