Hey splunk community!
I need to create a search query to find instances where the time between a "Cache set' log from my application and a "Cache miss" log is not equal to a certain value(The configured TTL), for any cache key.
I've attempted starting with a particular key(sampleKey) but the end goal is to tabularize these results for all keys.
Here's my attempt to calculate the time difference for a sampleKey, between the set and miss times :
index= authzds-e2e* "setting value into memcached" "key=sampleKey" [search index=authzds-e2e* "Cache status=miss" "key=sampleKey" | stats latest(_time) as missTime ] | stats earliest(_time) as setTime| eval timeDiff=setTime-missTime
My goal is to calculate the difference between consecutive set and miss events, key-wise (not earliest/latest as in the above query)
You can use transaction.
index= authzds-e2e* ("setting value into memcached" OR "Cache status=miss")
| transaction key startswith="Cache status=miss" endswith="setting value into memcached"
| stats avg(duration) by key
Of course, transaction is expensive. So use stats