Splunk Search

How to calculate the time difference between request and response log entries?

vamsi199
Engager

I need to calculate time difference between two (request and response) entries in log

I have logs like below

Request : 23/11/2016 22:03:15,Host1,CheckStatusRequest, cb7319d4-a90f-4c2d-8f5b-5d0f2592fede
Response : 23/11/2016 22:03:17,Host1,CheckStatusResponse, cb7319d4-a90f-4c2d-8f5b-5d0f2592fede,  ResponseCode: SUCCESS

Thanks

0 Karma
1 Solution

HiroshiSatoh
Champion

You can calculate it using the transaction command.

When the field name is as follows
ex.
_time,host,CheckStatus,KeyCode,ResponseCode
23/11/2016 22:03:15,Host1,CheckStatusRequest, cb7319d4-a90f-4c2d-8f5b-5d0f2592fede
23/11/2016 22:03:17,Host1,CheckStatusResponse, cb7319d4-a90f-4c2d-8f5b-5d0f2592fede, ResponseCode: SUCCESS

your search| transaction host,KeyCode startswith="CheckStatusRequestSTART" endswith="CheckStatusResponse"|table host,key,duration

View solution in original post

HiroshiSatoh
Champion

You can calculate it using the transaction command.

When the field name is as follows
ex.
_time,host,CheckStatus,KeyCode,ResponseCode
23/11/2016 22:03:15,Host1,CheckStatusRequest, cb7319d4-a90f-4c2d-8f5b-5d0f2592fede
23/11/2016 22:03:17,Host1,CheckStatusResponse, cb7319d4-a90f-4c2d-8f5b-5d0f2592fede, ResponseCode: SUCCESS

your search| transaction host,KeyCode startswith="CheckStatusRequestSTART" endswith="CheckStatusResponse"|table host,key,duration

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!