Need to Calculate Response Time matching Index ID between 2 lines in the search

[lsanthoshbe]

If look the below screen shot due to multiple calls in same time some time response takes a while and we need to match the ID and calculate difference
right now i am using the below query this works well if we have request and response comes next to each other

index=e1prd host=pite1bspd1 sourcetype=e1_npd_bssv PublishedMethod | transaction transid startswith="startPublishedMethod" endswith="finishPublishedMethod" | rename duration as Response_Time |table Instance_ID,Response_Time

Please advise
Thanks,
Santhosh

[woodcock · Accepted solution]

Try this:

index=e1prd host=pite1bspd1 sourcetype=e1_npd_bssv *PublishedMethod*
| streamstats count(eval(searchmatch("finishPublishedMethod"))) AS sessionID BY instance_ID transid
| stats range(_time) AS Response_Time BY sessionID instance_ID transid

[lsanthoshbe]

Excellent Gregg!! Thanks for you support !! i used this below query and looks like working now
i really appreciate your support

index=e1stg host=pite1bsqa2  *PublishedMethod*
| streamstats count(eval(searchmatch("finishPublishedMethod"))) AS sessionID BY Instance_ID_QA
| stats range(_time) AS Response_Time BY sessionID Instance_ID_QA
| table Instance_ID_QA,Response_Time

[macadminrohit]

you can first try to convert your time to epoch using strptime and then use streamstats to group together both the events with the same id and then calculate the difference.

[lsanthoshbe]

if you can provide exact query / sample that would be great !!
Thanks for your help