Hi,
we have few micro services which are running on pivotal.i would like find the time duration from starting to end flow based on session id.
i got few values for 1 minute duration,which has the same session id but different end points and micro services.
attaching the file which has some fields and values.
link text
Give this a try
your base search | stats min(_time) as start max(_time) as end by cf_session_id | eval duration=end-start | convert ctime(start) ctime(end) | eval duration=tostring(duration,"duration")
Give this a try
your base search | stats min(_time) as start max(_time) as end by cf_session_id | eval duration=end-start | convert ctime(start) ctime(end) | eval duration=tostring(duration,"duration")