Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Response Time Calculation between 2 different even...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Response Time Calculation between 2 different events
Hello,
I am trying to find response time between events in different sourcetype but not able to figure out how to find time difference. For some it is coming correctly but for some value is coming negative , look like end time value is not coming correctly. Below is the search I am using. I need to find value based on common conversation ID and find avg by action. I tried with transaction but with conversation id is not having same value for all the events and transaction is not working.
index=A sourcetype="A_log4j" "Input Validation Passed" | rex "CONV_ID\s:\s(?.+)" | stats values(_time) as start by conversation_id | appendcols [search index=A sourcetype="B_log4j" "Outbound payload received" | rex "convId:\s(?[^/,]+)" | rex "action:\s(?[^/,]+)" | stats values(_time) as end by conversation_id,action] | eval diff=tonumber(start-end)| table conversation_id start action end diff.
For some : getting wrong value for subsearch and hence diff time is coming incorrectly. Please advise how I can find response time in this scenario.
Thanks much!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you need | stats abs(max(_time) - min(_time)) then just use | stats range(_time).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
instead of values(_time) try earliest or min in both the base search and the subsearch.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
still getting the same results.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
when you run the subsearch on its own, are you getting the correct time? grab one conversation_id and action that looked wrong and check the events and then add the stats command. does that match the indexed _time?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Also in both the source time format is different for first search it is like this : 06-Aug-2017 17:00:31,381, for subsearch data it is 2017-08-06 17:00:31
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
index=myindex1
eventName=5000 --->have b(starting time and ending time ) and reference id
eventName=5001 --->have (starting time and ending time ) and reference id
here my condition if both event names - reference id are same then,
event 5000 stating time and event 5001 ending time and total duration of time and average time I need to show in dashboards
can you please provide query
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
