I want to calculate response time from my logs for all records and our application logs in below format,
Can you please provide query for this?
[2019-04-15 16:49:32.295 GMT][INFO ] [{txnId=wcf_98Y64BaiB3}][Info] - stage : Create Relationship started
[2019-04-15 16:49:32.314 GMT][INFO ] [{txnId=wcf_98Y64BaiB3}][Info] - stage : Create started
[2019-04-15 16:49:32.333 GMT][INFO ] [{txnId=wcf_98Y64BaiB3}][Info] - stage : The status of managed account = PENDING
[2019-04-15 16:49:32.602 GMT][INFO ] [{txnId=wcf_98Y64BaiB3}][Info] - stage : Create Relationship competed
[2019-04-15 16:49:32.602 GMT][INFO ] [{txnId=wcf_98Y64BaiB3}][Info] - stage : Create Relationship call executed
Give this method a try (transaction command can be easy to implement but is awfully resource expensive)
index=foo sourcetype=bar ( Create Relationship started ) OR ( Create Relationship call executed )
| stats min(_time) as startedOn max(_time) as endedOn by txnId
| eval response_time=endedOn-startedOn
| convert ctime(*On) as *On
Have you tried transaction
? Try adding | transaction startswith="Create Relationship started" endswith="Create Relationship call executed"
to your search. There will be a field called duration
that will tell you how much time elapsed.