Find time difference between two events with different search conditions and same keys, compile all difference by keys?

[roshankandeIntu]

Hey splunk community!

I need to create a search query to find instances where the time between a "Cache set' log from my application and a "Cache miss" log is not equal to a certain value(The configured TTL), for any cache key.

I've attempted starting with a particular key(sampleKey) but the end goal is to tabularize these results for all keys.

Here's my attempt to calculate the time difference for a sampleKey, between the set and miss times :

index= authzds-e2e* "setting value into memcached" "key=sampleKey" [search index=authzds-e2e* "Cache status=miss" "key=sampleKey" | stats latest(_time) as missTime ] | stats earliest(_time) as setTime| eval timeDiff=setTime-missTime

My goal is to calculate the difference between consecutive set and miss events, key-wise (not earliest/latest as in the above query)

[yuanliu]

You can use transaction.

index= authzds-e2e* ("setting value into memcached" OR "Cache status=miss")
| transaction key startswith="Cache status=miss" endswith="setting value into memcached"
| stats avg(duration) by key

 Of course, transaction is expensive.  So use stats