Splunk Search

Finding duration, average time, maximum time for specific logs

pushpender07
Explorer

The logging that we do is not perfect hence need some help.

Log 1 (request) - {"date":"19-04-2018 21:40:11,221", "transactionId":"123", "className":"Class1", "methodName":"login", "elapsedTime":"2284896391"}
Log 2 (response)- {"date":"19-04-2018 21:40:11,253", "transactionId":"123", "className":"Class1", "methodName":"login", "elapsedTime":"2317835633"}

Log 1 is the request, Log 2 is the response. I want to find the duration of each login service request/ response. Transaction id is same in both cases so could be used as a unique value. Not sure what elapsedTime represents.

Any help would be highly appreciated.

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

Your Base Search | stats range(_time) AS duration BY transactionId

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

Your Base Search | stats range(_time) AS duration BY transactionId
0 Karma

pushpender07
Explorer

Thanks for the help

0 Karma

woodcock
Esteemed Legend

You might also like to add:

| eval duration=tostring(duration, "duration")
0 Karma

HeinzWaescher
Motivator

Try this:

| eval date=strptime(date,"%d-%m-%Y %H:%M:%S,%3N")
| stats min(date) AS start, max(date) AS max_date BY transactionId
| eval duration=max_date-min_date

0 Karma

pushpender07
Explorer

This created transactionId, start, and max_date. It doesn't show the duration though. This is helpful though, I will try to take it from here.

0 Karma

p_gurav
Champion

Try something like:

| transaction transactionId

it will create duration field.

0 Karma

pushpender07
Explorer

Thanks, this helped

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...