Splunk Search

How do I find the time difference between these events?

dhavamanis
Builder

We have the events like below (fields like flowId, action..etc) and need a final output between the events (action = FLOW_END_SUCCESS and FLOW_START) time difference based on flowId,

2016-05-18 21:33:10,208 INFO [pool-3-thread-1] c.n.m.l.EventLogger [EventLogger.java:18] env=DEV, flowId=1463607190206, flow=INTAKE, type=player, action=FLOW_END_SUCCESS, mpxId=116310, accountId=46862
2016-05-18 21:33:10,208 INFO [pool-3-thread-1] c.n.m.l.EventLogger [EventLogger.java:18] env=DEV, flowId=1463607190206, flow=INTAKE, type=player, action=SAVE_ITEM_TO_DB_END, mpxId=116310, accountId=46862
2016-05-18 21:33:10,207 INFO [pool-3-thread-1] c.n.m.l.EventLogger [EventLogger.java:18] env=DEV, flowId=1463607190206, flow=INTAKE, type=player, action=SAVE_ITEM_TO_DB_START, mpxId=116310, accountId=46862
2016-05-18 21:33:10,206 INFO [pool-3-thread-1] c.n.m.l.EventLogger [EventLogger.java:18] env=DEV, flowId=1463607190206, flow=INTAKE, type=player, action=FLOW_START, mpxId=116310, accountId=46862
2016-05-18 21:33:05,269 INFO [pool-3-thread-1] c.n.m.l.EventLogger [EventLogger.java:18] env=DEV, flowId=1463607185173, flow=INTAKE, type=player, action=FLOW_END_SUCCESS, mpxId=116310, accountId=46857
2016-05-18 21:33:05,269 INFO [pool-3-thread-1] c.n.m.l.EventLogger [EventLogger.java:18] env=DEV, flowId=1463607185173, flow=INTAKE, type=player, action=SEND_ITEM_TO_QUEUE_END_SUCCESS, mpxId=116310, accountId=46857

Final output:

flowId,    time_difference_in_ms
1463607185173,   1234
1463607190206,   5678
0 Karma
1 Solution

sundareshr
Legend

See if this gives you what you're looking for

| stats values(eval(if(action="FLOW_START", _time, null()))) AS start values(eval(if(action="FLOW_END_SUCCESS", _time, null()))) AS end by flowId | eval dur=tostring(end-start, "duration")

View solution in original post

sundareshr
Legend

See if this gives you what you're looking for

| stats values(eval(if(action="FLOW_START", _time, null()))) AS start values(eval(if(action="FLOW_END_SUCCESS", _time, null()))) AS end by flowId | eval dur=tostring(end-start, "duration")

dhavamanis
Builder

Can you provide the query to get the duration in milliseconds . currently its showing like "00:00:00.094"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...