Finding duration, average time, maximum time for specific logs

[pushpender07]

The logging that we do is not perfect hence need some help.

Log 1 (request) - {"date":"19-04-2018 21:40:11,221", "transactionId":"123", "className":"Class1", "methodName":"login", "elapsedTime":"2284896391"}
Log 2 (response)- {"date":"19-04-2018 21:40:11,253", "transactionId":"123", "className":"Class1", "methodName":"login", "elapsedTime":"2317835633"}

Log 1 is the request, Log 2 is the response. I want to find the duration of each login service request/ response. Transaction id is same in both cases so could be used as a unique value. Not sure what elapsedTime represents.

Any help would be highly appreciated.

[woodcock · Accepted solution]

Like this:

Your Base Search | stats range(_time) AS duration BY transactionId

[pushpender07]

Thanks for the help

[woodcock]

You might also like to add:

| eval duration=tostring(duration, "duration")

[HeinzWaescher]

Try this:

| eval date=strptime(date,"%d-%m-%Y %H:%M:%S,%3N")
| stats min(date) AS start, max(date) AS max_date BY transactionId
| eval duration=max_date-min_date

[pushpender07]

This created transactionId, start, and max_date. It doesn't show the duration though. This is helpful though, I will try to take it from here.

[p_gurav]

Try something like:

| transaction transactionId

it will create duration field.

[pushpender07]

Thanks, this helped