Splunk Search

How to get the duration in seconds from a multiline event?

icyfeverr
Path Finder

I am trying to find the best way to get the duration (in seconds) on a multiline event, possibly having it captured during indexing. I know I can use rex/field extractions and use the eval command at search-time, but was hoping for some more ideas.

Example:

--------------------[Start Session - 2015-08-18 10:47:27.000]-------------------
[2015-08-18 10:47:27.000][INFO]Attempting to connect...
[2015-08-18 10:47:27.000][INFO]Sending request
[2015-08-18 10:47:27.000][INFO]Retrieving response
[2015-08-18 10:47:29.000][INFO]Response size = 627 bytes
---------------------[End Session - 2015-08-18 10:47:29.000]--------------------

Duration = 2 (seconds)

Thanks in advance.

Tags (2)
0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

Well, your non-search-time options are really only index-time extractions - most likely, this isn't what you actually want.

You could edit props.conf to include an extraction of the time so its always extracted, then use a calculated field to automatically create the duration between the _time & the second time field. Is that an example of something you might be looking for ?

icyfeverr
Path Finder

Yes, that is a potential solution. I was really hoping there was a way to have the multiline event act like the transaction command and have it apply a duration field to the event upon index.

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

What necessitates it being at index time? Search time field exrtraction / creation isn't normally a bottleneck, especially if you're searching smart & using the fields command, etc.

icyfeverr
Path Finder

Ok, so utilizing the field extractions for the End Session time is all that would be needed then, since the start time is associated to Start Session time, then just use the eval to translate the string to an epoch time and then subtracting the two to get the second difference. I guess I will go with that, I was just trying to see if there was a different/better way of going about it. Thanks.

0 Karma

jensonthottian
Contributor

Transaction command finds transactions based on events that meet various constraints. Transactions are made up of the raw text (the _raw field) of each member, the time and date fields of the earliest member, as well as the union of all other fields of each member.
Additionally, the transaction command produces two fields to the raw events, duration and eventcount. The duration value is the difference between the timestamps for the first and last events in the transaction.

| transaction startswith="Start Session" endswith="End Session"

icyfeverr
Path Finder

I appreciate the response, but the Transaction command can not be applied to a multi-line-event, as a multi-line-event is essentially, at least in this case, a "transaction" already. The text example you see above is a "single" event since it was indexed as a multi-line event.

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...