Solved: Time Duration between each session - Splunk Community

Splunk Search

Hi,
we have few micro services which are running on pivotal.i would like find the time duration from starting to end flow based on session id.

i got few values for 1 minute duration,which has the same session id but different end points and micro services.

attaching the file which has some fields and values.
link text

1 Solution

Solution

Give this a try

your base search | stats min(_time) as start max(_time) as end by cf_session_id | eval duration=end-start | convert ctime(start) ctime(end) | eval duration=tostring(duration,"duration")

View solution in original post

Solution

Give this a try

your base search | stats min(_time) as start max(_time) as end by cf_session_id | eval duration=end-start | convert ctime(start) ctime(end) | eval duration=tostring(duration,"duration")

Get Updates on the Splunk Community!

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next. Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Watch Now Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas Do you ever feel ...