Splunk Search

How to calculate time difference of 2 events with logs that do not have a common string?

huligesh
Engager

Hi,
I have Siebel logs like below:
event 1:
MessageFlow MsgFlowDetail 4 00005609588f0d40:0 2017-01-30 09:38:48 7676: Returned from SessionHandleMsg(200) for task 27263382, pErrStack = 0x2a2d6bf0
..
.. (after few events)
event n:
MessageFlow MsgFlowDetail 4 00005609588f0d40:0 2017-01-30 09:38:47 7676: Calling SessionHandleMsg(200) for task 27263382, pErrStack = 0x2a2d6bf0

I need to extract the timestamp and find difference to get response time data.

Thanks

0 Karma
1 Solution

s2_splunk
Splunk Employee
Splunk Employee

If the field with value 00005609588f0d40:0 is your MessageFlowID, you can do <search> | transaction mflowID startsWith="Calling" endsWith="Returned"
After the search executes, you will have a new field called duration generated by the transaction command that gives you the delta between start and end of this "transaction".

Note: transaction is a pretty expensive command, use it over the smallest event set/time frame possible. If this produces what you want, you may be able to rewrite the search more efficiently without using transaction. You can take a look at this answer for an example.

But first things first.

View solution in original post

woodcock
Esteemed Legend

Do not use transaction; try this:

You Base Search | stats range(_time) BY mflowID
0 Karma

s2_splunk
Splunk Employee
Splunk Employee

If the field with value 00005609588f0d40:0 is your MessageFlowID, you can do <search> | transaction mflowID startsWith="Calling" endsWith="Returned"
After the search executes, you will have a new field called duration generated by the transaction command that gives you the delta between start and end of this "transaction".

Note: transaction is a pretty expensive command, use it over the smallest event set/time frame possible. If this produces what you want, you may be able to rewrite the search more efficiently without using transaction. You can take a look at this answer for an example.

But first things first.

huligesh
Engager

Thanks for the answer.

0 Karma

gokadroid
Motivator

I see almost everything common between the two strings:

MessageFlow MsgFlowDetail 4 00005609588f0d40:0 2017-01-30 09:38:48 7676: Returned from SessionHandleMsg(200) for task 27263382, pErrStack = 0x2a2d6bf0
..
.. (after few events)
event n:
MessageFlow MsgFlowDetail 4 00005609588f0d40:0 2017-01-30 09:38:47 7676: Calling SessionHandleMsg(200) for task 27263382, pErrStack = 0x2a2d6bf0

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...