How to get time duration between consecutive events in the same search results?

[gsingal]

In my logs, I have some events like:
time1 eventStart
time2 eventFinish
time3 eventStart
time4 eventFinish
time5 eventStart
time6 eventFinish

I want to get the time difference between start and finish event.
So, the result should be 3 rows, having time diff between: time2-time1, time4-time3, time6-time5

Can you please help?

[ckdoan]

Hi, were you able to figure this out?

[skoelpin]

Can you provide us your query and some sample data?

You need to group the events together using the Transaction command.. So if you have your eventStart as a seperate event from your eventFinish then the transaction command will group them both as 1 event then you can find the duration

So it would look something like this

.. | transaction startswith="eventStart" endswith="eventFinish" | timechart avg(duration)

[bmacias84]

Look at using transaction command