How to calculate time difference of 2 events with logs that do not have a common string?

[huligesh]

Hi,
I have Siebel logs like below:
event 1:
MessageFlow MsgFlowDetail 4 00005609588f0d40:0 2017-01-30 09:38:48 7676: Returned from SessionHandleMsg(200) for task 27263382, pErrStack = 0x2a2d6bf0
..
.. (after few events)
event n:
MessageFlow MsgFlowDetail 4 00005609588f0d40:0 2017-01-30 09:38:47 7676: Calling SessionHandleMsg(200) for task 27263382, pErrStack = 0x2a2d6bf0

I need to extract the timestamp and find difference to get response time data.

Thanks

[woodcock]

Do not use transaction; try this:

You Base Search | stats range(_time) BY mflowID

[s2_splunk · Accepted solution]

If the field with value 00005609588f0d40:0 is your MessageFlowID, you can do <search> | transaction mflowID startsWith="Calling" endsWith="Returned"
After the search executes, you will have a new field called duration generated by the transaction command that gives you the delta between start and end of this "transaction".

Note: transaction is a pretty expensive command, use it over the smallest event set/time frame possible. If this produces what you want, you may be able to rewrite the search more efficiently without using transaction. You can take a look at this answer for an example.

But first things first.

[huligesh]

Thanks for the answer.

[gokadroid]

I see almost everything common between the two strings:

MessageFlow MsgFlowDetail 4 00005609588f0d40:0 2017-01-30 09:38:48 7676: Returned from SessionHandleMsg(200) for task 27263382, pErrStack = 0x2a2d6bf0
..
.. (after few events)
event n:
MessageFlow MsgFlowDetail 4 00005609588f0d40:0 2017-01-30 09:38:47 7676: Calling SessionHandleMsg(200) for task 27263382, pErrStack = 0x2a2d6bf0