How to get the difference of time between 2 events

[gajananh999]

Hello Everyone,

I have events like

02-Jul-2014 09:25:25 AM: ========== Finish Transmit Process ==========

02-Jul-2014 09:25:25 AM: AA Proc for AttachmentTransmission

02-Jul-2014 09:25:25 AM: AA Software (Axway Synchrony) version is not setup in ESM Schema in table EDI_TYPE_CD. Default version of EDI Software is 4.2

02-Jul-2014 09:25:25 AM: AA Service Login to 'AA' Database with UserID 'AA' Successfully

02-Jul-2014 09:25:23 AM: ========== Start Transmit Process ==========

So i want to find out the Time which is take by process to complete its task. So here it will be 02.02 sec

Thanks

Gajanan Hiroji

[youngc_splunk]

@gajananh999 , it looks like your processing EDI data. We do have a new solution accelerator for EDI transactions.  Love to share some content we have.   Let me know if you're interested.

[Ayn · Accepted solution]

Create a transaction that starts with the "Start Transmit Process" line and ends with the "Finish Trnamit Process" line. The transaction command will automatically create a field duration which gives you the duration of the transaction, which is the same as the time difference between the start and end event.

... | transaction startswith="========== Start Transmit Process ==========" endswith="========== Finish Transmit Process =========="

[gajananh999]

Thanks Ayn.