How to find last of A and first of B in one query?

[mrhodes93]

Considering the following two messages:

sourcetype="PCF:log" cf_app_name=app1 msg="launch processing started" UserID: ABC

sourcetype="PCF:log" cf_app_name=app1 msg="flow complete" UserID: ABC

I want to capture the elapsed time between the earliest occurrence of "launch processing started", and the latest occurrence of "flow complete", by matching on UserID (which I've regex extracted to a field).  How would I approach this? 

Edit: I should mention this is timeboxed to one day. If a user launches but doesn't complete in a day, I don't care.

[richgalloway · Accepted solution]

That's a textbook example of the transaction command.  Note, this does not handle nested start/stop event pairs.

index=foo ("launch processing started" OR "flow complete")
`comment("Insert rex command that extracts UserID field")`
| transaction UserID startswith="launch processin started" enswith="flow complete"
| table UserID duration

[mrhodes93]

This is fantastic, I'm fairly new to splunk and was not aware of transaction.  It seems as though it overcomes an issue like:

launch, complete, launch (exit without completing)

The second launch without a complete is not considered part of the transaction, hence the time is discarded from the calculation.  Am I understanding that correctly? 

[richgalloway]

Yes, you are understanding it correctly.

Be aware, though, that the transaction command can be slow.