Splunk Search

how to calculate time difference between multiple events based on ID

rkishoreqa
Communicator

I have one requirement to calculate the time difference between multiple events based on JobId.  The logs are like below.  From the below logs I need to fetch time stamps for each jobId which having multiple events.
And calculate the difference between the timestamps and assign to the jobId like : bw0a10db49 - (2 mins)

2020-10-14 12:41:40.468 INFO [Process Worker-9]Log - 2020-10-14T12:41:40.468-04:00 - INFO - jobId: bw0a10db49;
Msg: Application testing.application started
2020-10-14 12:41:41.362 INFO [Process Worker-9]Log - 2020-10-14T12:41:40.468-04:00 - INFO - jobId: bw0a10db49;
Msg: Application testing.application started
2020-10-14 12:41:42.480 INFO [Process Worker-6]Log - 2020-10-14T12:41:42.48-04:00 - INFO - jobId: bw0a10db49;
Msg: EndOfFile Submited to ConcurentWebservice

 

Please suggest me with the query.

 

Thanks in advance.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| stats earliest(_time) as start latest(_time) as end by jobid
| eval diff=end-start

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| stats earliest(_time) as start latest(_time) as end by jobid
| eval diff=end-start

rkishoreqa
Communicator

I prepared the below as you suggested, it is working fine. 

> index=tibco_44_bw6_dev | rex field=_raw "jobId: (?<jId>\w+);" | stats earliest(_time) as start latest(_time) as end by jId | eval diff=end-start |where diff >1000

I got the below results and difference is 3619, how can convert it to minutes.

image.png

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| fieldformat diff=tostring(diff,"duration")
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...