How to find tolerant match between two events?

[avi7326]

I want to know how long will tolerant  match takes to give the result between the event requested and the event  response  using any correlation Id. It should also calculate the average duration median duration.

[avi7326]

tolerant match is that we have to check that the account is existing or we have to create a new one that is to be done by tolerant match and we have to monitor how long will it take to process the address

[ITWhisperer]

How do you determine if the account exists or not?

[avi7326]

I have to calculate the time it takes  between request to tolerant match log and response to tolerant match log

[ITWhisperer]

How are you defining "tolerant match"?

[avi7326]

I have used this query for a particular time period but it is not showing any result and what if the day changes so this query will not work this is not scalable so what should I do.

| eval swipe=strptime($In Swipe$,'%d/%m/%y %H:%M:%S') | eval login=strptime(LoginTime,'%d/%m/%y %H:%M:%S') | eval diff = swipe-login | where diff > 0