How to generate a search for my sample data?

[prashanthberam]

i have logs like this for each req.....

2016-11-09 12:57:18,855  CorrelationID=2469bae9-fe14-4e67-b345-95d652f4a868, DCN =02016047501V1370X, TransactionTimestamp =1478717835696 , GroupNumber =000142003, ServiceLinecount=xx,  SectionNumber =0001, CorporateEntityCode =TX1, ClaimType=0, VendorName =XXX, VendorCode=xxx, TransactionCode=REQ 

2016-11-09 12:57:18,855  CorrelationID=2469bae9-fe14-4e67-b345-95d652f4a868, DCN =02016047501V1370X, TransactionTimestamp =1478717835696, GroupNumber =000142003, ServiceLineCount=xxx,  SectionNumber =0001, CorporateEntityCode =TX1, ClaimType=0, VendorName =XXX, VendorCode=xxx, TransactionCode=Ack, OutCome= Success , Message text=xxxx

2016-11-09 12:57:18,855 CorrelationID=2469bae9-fe14-4e67-b345-95d652f4a868, DCN =02016047501V1370X, TransactionTimestamp =1478717835696, GroupNumber =000142003, ServiceLineCount=xxx,  SectionNumber =0001, CorporateEntityCode =TX1, ClaimType=0, VendorName =XXX, VendorCode=xx, TransactionCode=Response ,UtilizationAmount=xxx.

In each message up to vendor code everything is similar ..
i need a table with all the details information along with how much time it has taken between req,ACK and ACK,RSP in single table...so that later on i want to build the summary index with those search.....
is anyone help in this could appreciate that...!! thanks in advance...

[somesoni2 · Accepted solution]

Give this a try (assuming CorrelationID is the primary key. If there are additional fields that differentiate uniq transaction, add them to stats)

your base search | fields _time CorrelationID DCN TransactionTimestamp GroupNumber ServiceLineCount SectionNumber CorporateEntityCode ClaimType VendorName VendorCode TransactionCode OutCome Message_Text UtilizationAmount | eval ReqTime=if(TransactionCode="REQ",_time,null()) | eval AckTime=if(TransactionCode="Ack",_time,null()) | eval RespTime=if(TransactionCode="Response",_time,null()) | stats values(*) as * by CorrelationID | eval DurationReq_Ack=AckTime-ReqTime | eval DurationAck_Resp = RespTime-AckTime

[prashanthberam]

thanks...it's working...can i make it as a summary report....