How do you find the time difference for fields within transactions?

[venkatrajan04]

CorrelationID=1==, CaseID=2 endProcess=SubmitInfo , 2019-02-02 11:02:06,130
CorrelationID=1==, CaseID=2 STartProcess=SubmitInfo , 2019-02-02 11:02:05,130
CorrelationID=1==, CaseID=2 EndProcess=ReviewInfo , 2019-02-02 11:02:04,130
CorrelationID=1==, CaseID=2 StartProcess=ReviewInfo , 2019-02-02 11:02:03,130
CorrelationID=1==, CaseID=2  Intent=OrderScheduling 2019-02-02 11:02:02,130

I have a list of processes for my application. What I would need to find is the screentime between events.

That is I need to find the screen time for a particular intent.

I have tried using transaction to group the event with starttime and end time, but somehow, I am not able to find the screen times by intent. I can find the screen times regardless

I am looking for something like the one below.

 Intent                        process .             duration
Order Scheduling .   ReviewInfo .      1sec
                                    SUbmit Info       2 sec

[woodcock]

How about this:

| makeresults 
| eval raw="CorrelationID=1==, CaseID=2 endProcess=SubmitInfo , 2019-02-02 11:02:06,130:::CorrelationID=1==, CaseID=2 STartProcess=SubmitInfo , 2019-02-02 11:02:05,130:::CorrelationID=1==, CaseID=2 EndProcess=ReviewInfo , 2019-02-02 11:02:04,130:::CorrelationID=1==, CaseID=2 StartProcess=ReviewInfo , 2019-02-02 11:02:03,130:::CorrelationID=1==, CaseID=2 Intent=OrderScheduling 2019-02-02 11:02:02,130" 
| makemv delim=":::" raw 
| mvexpand raw 
| rename raw AS _raw

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution."

| rex "^CorrelationID=(?<CorrelationID>\d+)\S+\s+CaseID=(?<CaseID>\d+)\s+(?:(?:(?<startORstop>((?i)start|end))Process=)|(?:(?<Intent>Intent)=))(?<process>\S+).*?(?<_time>\d{4}-.*)$"
| eval _time = strptime(_time, "%Y-%m-%d %H:%M:%s,%3n")
| eval startORstop=lower(startORstop)
| appendpipe [ stats range(_time) AS duration BY CaseID CorrelationID | eval process="TOTAL"]
| stats range(_time) AS process_duration first(duration) AS total_duration BY CaseID CorrelationID process
| search process_duration>0 OR total_duration>0

[chrisyounger]

this is a better answer becuase it uses stats :thumbs_up:

[chrisyounger]

Hi @venkatrajan04

I have made this example that shows you how you can do what you want:

| makeresults 
| eval _raw = "
RAW
CorrelationID=1 CaseID=2 endProcess=SubmitInfo   2019-02-02 11:02:06
CorrelationID=1 CaseID=2 StartProcess=SubmitInfo 2019-02-02 11:02:05
CorrelationID=1 CaseID=2 EndProcess=ReviewInfo   2019-02-02 11:02:04
CorrelationID=1 CaseID=2 StartProcess=ReviewInfo 2019-02-02 11:02:03
CorrelationID=1 CaseID=2 Intent=OrderScheduling  2019-02-02 11:02:02" 
| multikv 
| extract 
| rex "\S+\s+\S+\s+[^=]+=(?<the_intent>\S+)\s+(?<the_time>\S+\s+\S+)"
| eval _time = strptime(the_time, "%Y-%m-%d %H:%M:%S")
| sort - _time
| transaction CorrelationID CaseID the_intent
| table CorrelationID CaseID the_intent duration eventcount

Remember that _time has to be in specific order for transaction to work properly.

Hope this solves your problem.