How can I calculate duration?

[jacknguyen]

Hi I want to calculate duration. For example, I have 2 different event in a source
First event:

04/03/2023   PLUGIN_CLIENT_CONNECT (this is not a field in event)
17:10:15.000 

Second event:

04/03/2023  PLUGIN_CLIENT_DISCONNECT  (this is not a field in event)
17:51:15.000

I want to cal duration between them.

Expected result with table:

Start Time            End Time            Hours Ago

04/03/2023       04/03/2023      41 minutes (and hours if have) 
17:10:15.000      17:51:15.000

Anyone can help me??? Thank you for pay time

[ITWhisperer]

How to you correlate the two events? For example, is there a field (or at least data) in both events which uniquely ties the two events together?

| eval starttime=if(<PLUGIN_CLIENT_CONNECT>,_time,null())
| eval endtime=if(<PLUGIN_CLIENT_DISCONNECT>,_time,null())
| stats value(starttime) as starttime values(endtime) as endtime by <unique correlation value field>
| eval duration=endtime-starttime

[jacknguyen]

in both event I have field is profile. Howerver both of that were extracted in different time. I tried to use join fuction with "profile" but the start time and end time column is empty when I use table. And Hours Ago column was shown Null Hours

[ITWhisperer]

It is always difficult to provide a complete solution without exact details of the problem.

Please can you share the events (anonymised of course) in a code block </> to preserve any formatting that may be present?

Also, please can you share the unsuccessful SPL you are using in case there is an error there?

[jacknguyen]

there are 2 logs about connect and disconnect. Both of them have same filed is profile (jack_nguyen)

[ITWhisperer]

Assuming the profile uniquely identifies the session you want to measure, try this

| rex "(?<event>PLUGIN_CLIENT_CONNECT|PLUGIN_CLIENT_DISCONNECT)"
| eval starttime=if(event=="PLUGIN_CLIENT_CONNECT",_time,null())
| eval endtime=if(event=="PLUGIN_CLIENT_DISCONNECT",_time,null())
| stats value(starttime) as starttime values(endtime) as endtime by profile
| eval duration=endtime-starttime

If it doesn't, do you want another field value that does uniquely tie these events together?