Subtracting two fields

[sintjm]

I extracted 2 fields called 'Resp_time' and 'Req_time'...Both these fields are integers.
I also changed the values to epoch 

How do I display the difference between the Resp_time and req_time?

[gcusello]

Hi @sintjm ,

if they are integers or they are in epochtime, you can calculate the difference using eval command:

<your_search>
 | eval diff=Resp_time-Req_time

Ciao.

Giuseppe

[sintjm]

Hi thanks but the problem is they are not from the same events as they are separate

[gcusello · Accepted solution]

Hi @sintjm ,

as also @yuanliu said, you need a correlation key to correlate the events, if you have, you can use it in a stats command and this is the best solution:

<your_search>
| stats 
    values(Resp_time) AS Resp_time 
    values(Req_time) AS Req_time 
    BY key
| eval diff=Resp_time-Req_time

If you haven't and you're sure that events are always sequential, you could use the transaction command:

<your_search>
| transaction maxevents=2
| table duration

Ciao.

Giuseppe

[sintjm]

thanks, I used a correlation key to correlate the events and it worked. 

[yuanliu]

You will need a common value in the two types of events to correlate events.  For example, if each pair has a unique transaction ID, you can do

| stats values(Resp_time) as Resp_time values(Req_time) as Req_time by transaction_id
| eval Resp_time - Req_time

Alternatively, if you have some other ways to determine a pairing, e.g., the two always happen within a deterministic interval,  e.g., request comes in at 5 minute into the hour, a unique response is sent within the hour and NO other request would come in during the same hour, you can use that as criterion.  There may be other conditions where you would use transaction.  Unless you give us the exact condition, mathematically there is no solution.

[sintjm]

Helped a lot, thanks.