Splunk Search

Find Difference between multiple events

New Member

TransID AppName timestamp Messagge
1 App1 2019-12-16 18:18:43.731 +0000 Message……
1 App1 2019-12-16 18:18:43.732 +0000 Before call: 1
1 App2 2019-12-16 18:18:43.743 +0000 Message…..
1 App2 2019-12-16 18:18:43.745 +0000 Message…..
1 App1 2019-12-16 18:18:43.807 +0000 After Call: 1
1 App1 2019-12-16 18:18:43.809 +0000 Message………
2 App1 2019-12-16 18:22:37.720 +0000 Message……
2 App1 2019-12-16 18:22:37.724 +0000 Before call: 2
2 App2 2019-12-16 18:22:37.755 +0000 Message…..
2 App2 2019-12-16 18:22:37.760 +0000 Message…..
2 App1 2019-12-16 18:22:37.820 +0000 After Call: 2
2 App1 2019-12-16 18:22:37.822 +0000 Message………

I have data in above format and I want to get the output as a report which shows how much time each AppName takes to process a tarnsaction. in below format:

TransID App1 App2 ....
1 0.002 0.002 ....
2 0.006 0.005 ...

I tried using transaction command but it gives me the duration based on the first and last event. but In my case I need how much time a transaction was in a particular app?

Thanks.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

You should be able to do that with stats. First, convert the timestamp field into epoch form so the difference can be computed.

... | eval ts=strptime(timestamp, "%Y-%m-%d %H:%M:%S.%3N")
| stats range(ts) by TransID AppName
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

You should be able to do that with stats. First, convert the timestamp field into epoch form so the difference can be computed.

... | eval ts=strptime(timestamp, "%Y-%m-%d %H:%M:%S.%3N")
| stats range(ts) by TransID AppName
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

New Member

Thanks it worked 🙂

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!