Splunk Search

How to calculate duration between two log entries?

splunkhadi_480
Engager

i have the following two entries

 

Time Event
8/16/22
1:46:22.592 PM
2022/08/16 13:46:22.592154:P_GUI_SERV06 :pbaho3 : 98(cli) : Exit Allocate Order on portfolio list [ABC_DPM_MM_BALANCED] with all instruments (Thread:00000001197f4730)
host = PBIPSG07source = /app/PBISG/aaa/current/msg/server.logsourcetype = prd-pbisg-server-logtimeendpos = 26timestartpos = 0
8/16/22
1:45:51.201 PM
2022/08/16 13:45:51.201360:P_GUI_SERV06 :pbaho3 : 98(cli) : Start Allocate Order on portfolio list [ABC_DPM_MM_BALANCED] with all instruments (Thread:00000001197f4730)
host = PBIPSG07

 

The entry will start with an entry like 'Start Allocate Order' and end with "Exit Allocate Order"

 

how do i build a Splunk search to calculate the duration taken between those two event ?

 

Based on the above , i would like to build more complex search:

notice that there is ':pbaho3:' , so there will be multiple users in this case is 'pbaho3' , so how do i group the entries by specific users ?

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @splunkhadi_480,

you have an easy way to xorrelate events using the transpose command (https://docs.splunk.com/Documentation/Splunk/9.0.0/SearchReference/Transaction) but it depends on the firld you extracted, I suppose that you already extracted all of them:

<your_search>
| transaction portfolio_list user startswith="Start Allocate Order" endswith="Exit Allocate Order"
| table _time portfolio_list user duration

but it's a very slow command, so you could try this solution:

<your_search> ("Start Allocate Order" OR "Exit Allocate Order")
| stats earliest(_time) AS earliest latest(_time) AS latest BY portfolio_list user
| eval duration=latest-earliest
| table _time portfolio_list user duration

Ciao.

Giuseppe

 

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @splunkhadi_480,

you have an easy way to xorrelate events using the transpose command (https://docs.splunk.com/Documentation/Splunk/9.0.0/SearchReference/Transaction) but it depends on the firld you extracted, I suppose that you already extracted all of them:

<your_search>
| transaction portfolio_list user startswith="Start Allocate Order" endswith="Exit Allocate Order"
| table _time portfolio_list user duration

but it's a very slow command, so you could try this solution:

<your_search> ("Start Allocate Order" OR "Exit Allocate Order")
| stats earliest(_time) AS earliest latest(_time) AS latest BY portfolio_list user
| eval duration=latest-earliest
| table _time portfolio_list user duration

Ciao.

Giuseppe

 

splunkhadi_480
Engager

Thank you so much Giuseppe for your help

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...