I have one requirement to calculate the time difference between multiple events based on JobId. The logs are like below. From the below logs I need to fetch time stamps for each jobId which having multiple events.
And calculate the difference between the timestamps and assign to the jobId like : bw0a10db49 - (2 mins)
2020-10-14 12:41:40.468 INFO [Process Worker-9]Log - 2020-10-14T12:41:40.468-04:00 - INFO - jobId: bw0a10db49;
Msg: Application testing.application started
2020-10-14 12:41:41.362 INFO [Process Worker-9]Log - 2020-10-14T12:41:40.468-04:00 - INFO - jobId: bw0a10db49;
Msg: Application testing.application started
2020-10-14 12:41:42.480 INFO [Process Worker-6]Log - 2020-10-14T12:41:42.48-04:00 - INFO - jobId: bw0a10db49;
Msg: EndOfFile Submited to ConcurentWebservice
Please suggest me with the query.
Thanks in advance.
| stats earliest(_time) as start latest(_time) as end by jobid
| eval diff=end-start
| stats earliest(_time) as start latest(_time) as end by jobid
| eval diff=end-start
I prepared the below as you suggested, it is working fine.
> index=tibco_44_bw6_dev | rex field=_raw "jobId: (?<jId>\w+);" | stats earliest(_time) as start latest(_time) as end by jId | eval diff=end-start |where diff >1000
I got the below results and difference is 3619, how can convert it to minutes.
| fieldformat diff=tostring(diff,"duration")