Splunk Search

How to search the difference between the start and end time for each command from a script log and timechart the durations?

vasavigangana
Explorer

How do I search the difference between the start and end timestamps for each command in my script log and timechart the duration for each one?

I have a script log that looks like:

2015-02-16.46.580761857 , cmd1 = Start time of if 
2015-02-16.46.586912593 , cmd1 = end time of if 
2015-02-16.46.588503884 , cmd2 = Start time of if 
2015-02-16.46.589967322 , cmd2 = end time of if 
2015-02-16.46.591767534 , cmd3 = Start time of grep 
2015-02-16.46.595647254 , cmd3 = end time of grep 
2015-02-16.46.597398658 , cmd4 = Start time of if 
2015-02-16.46.598979442 , cmd4 = end time of if 
2015-02-16.46.600440199 , cmd5 = Start time of sed command 
2015-02-16.46.611868517 , cmd5 = end time of sed command 
2015-02-16.46.613545578 , cmd6 = Start time of if 
2015-02-16.46.614971442 , cmd6 = End time of if
0 Karma
1 Solution

HiroshiSatoh
Champion

What with this?
※After that, please calculate the duration .

.....your search.....|rex field=_raw "^(?P<Time>[^ ]+)\s+,\s+(?P<cmd_name>\w+)\s+=\s+(?P<status>\w+\s+\w+) of (?P<command>.+)"|eval start_time=if(status="Start time",Time,"")|eval end_time=if(status="end time" OR status="End time",Time,"")|table cmd_name,command,start_time,end_time|stats max(start_time) as start_time,max(end_time) as end_time by cmd_name,command

alt text

View solution in original post

HiroshiSatoh
Champion

What with this?
※After that, please calculate the duration .

.....your search.....|rex field=_raw "^(?P<Time>[^ ]+)\s+,\s+(?P<cmd_name>\w+)\s+=\s+(?P<status>\w+\s+\w+) of (?P<command>.+)"|eval start_time=if(status="Start time",Time,"")|eval end_time=if(status="end time" OR status="End time",Time,"")|table cmd_name,command,start_time,end_time|stats max(start_time) as start_time,max(end_time) as end_time by cmd_name,command

alt text

vasavigangana
Explorer

.....your search.....|rex field=_raw "^(?P[^ ]+)\s+,\s+(?P\w+)\s+=\s+(?P\w+\s+\w+) of (?P.+)"|eval start_time=if(status="Start time",Time,"")|eval end_time=if(status="end time" OR status="End time",Time,"")|table cmd_name,command,start_time,end_time|stats max(start_time) as start_time,max(end_time) as end_time by cmd_name,command

THE ABOVE QUERIE NOT WORKING ANY ONE CAN HELP ME ON THIS QUESTION URGENT........

EITHER I HAVE TO ANY CONFIGURATION THAT I HAVE TO TAKE CONG FILE THAT SPEC OR EXAMPLE CONFG FILE PLEASE HELP ONTHIS

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...