Splunk Search

Finding duration, average time, maximum time for specific logs

pushpender07
Explorer

The logging that we do is not perfect hence need some help.

Log 1 (request) - {"date":"19-04-2018 21:40:11,221", "transactionId":"123", "className":"Class1", "methodName":"login", "elapsedTime":"2284896391"}
Log 2 (response)- {"date":"19-04-2018 21:40:11,253", "transactionId":"123", "className":"Class1", "methodName":"login", "elapsedTime":"2317835633"}

Log 1 is the request, Log 2 is the response. I want to find the duration of each login service request/ response. Transaction id is same in both cases so could be used as a unique value. Not sure what elapsedTime represents.

Any help would be highly appreciated.

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

Your Base Search | stats range(_time) AS duration BY transactionId

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

Your Base Search | stats range(_time) AS duration BY transactionId

View solution in original post

0 Karma

pushpender07
Explorer

Thanks for the help

0 Karma

woodcock
Esteemed Legend

You might also like to add:

| eval duration=tostring(duration, "duration")
0 Karma

HeinzWaescher
Motivator

Try this:

| eval date=strptime(date,"%d-%m-%Y %H:%M:%S,%3N")
| stats min(date) AS start, max(date) AS max_date BY transactionId
| eval duration=max_date-min_date

0 Karma

pushpender07
Explorer

This created transactionId, start, and max_date. It doesn't show the duration though. This is helpful though, I will try to take it from here.

0 Karma

p_gurav
Champion

Try something like:

| transaction transactionId

it will create duration field.

0 Karma

pushpender07
Explorer

Thanks, this helped

0 Karma