How to calculate response time from logs?

[ajaynaralikar]

I want to calculate response time from my logs for all records and our application logs in below format,

19-02-2018 23:02:04:371 [RetrieveCompanyData][INFO ]: |BEM_Gateway_Request_MF Request Processing Summary(TransactionId-GCP_708425245) SCVT Recieved Request at 19-02-2018 23:02:04:367
19-02-2018 23:02:15:017 [RetrieveCompanyData][INFO ]: |BEM_Gateway_Response_MF Request Processing Summary(TransactionId-GCP_708425245) SCVT sent response back to consumer at 19-02-2018 23:02:15:015
so can you provide query to for this

[somesoni2]

Try like this. You can remove those rex statements if the fields are already extracted.

your base search for selecting only the request and response events
| rex "Recieved Request at (?<request>\d{2}-\d{2}-\d{4} \d{2}:\d{2}:\d{2}\.\d{3})"
| rex "sent response back to consumer at (?<response>\d{2}-\d{2}-\d{4} \d{2}:\d{2}:\d{2}\.\d{3})"
| rex "TransactionId-(?<transactionId>[^\)]+)"
| stats values(request) as request values(response) as response by transactionId
| convert mktime(request) mktime(response) timeformat="%d-%m-%Y %H:%M:%S.%3N" 
| eval responseTime=response-request

[ajaynaralikar]

I tried and I got result in below format. But I want one more column which will show (response-request) result

transactionId   request                     response

1 GCP_198253791 21-02-2018 08:13:32:045 21-02-2018 08:13:35:049
2 GCP_218300826 21-02-2018 08:22:25:047 21-02-2018 08:22:29:177
3 GCP_221454910 21-02-2018 08:06:52:611 21-02-2018 08:06:53:412

[mhoogcarspel_sp]

The eval at the end gives you the responseTime field that has that information, should just be there if you're not filtering fields after the eval, sounds like you might be filtering it out somewhere though?

Add this to the end for a bit of formatting/filtering:
| table transactionId responseTime request response

[ajaynaralikar]

I tried and got below result.
transactionId request response
1 GCP_198253791 21-02-2018 08:13:32:045 21-02-2018 08:13:35:049
2 GCP_218300826 21-02-2018 08:22:25:047 21-02-2018 08:22:29:177
3 GCP_221454910 21-02-2018 08:06:52:611 21-02-2018 08:06:53:412