Hello, apologies if this was stated previously. I have multiple calls - each RequestID with a RequestReceive and ResponseTransmit. I am trying to find the difference between the two timestamps below. The difference of ResponseTransmit timestamp and  RequestReceive timestamp. Then put that into a stats command ordered by clientPathURI and then the difference between the timestamps. Any assistance is much appreciated!   { [-]     RequestID :  b74fab20-9a7b-11ed-bd70-c503548afa99     clientPathURI :  signup     level :  Info     logEventType :  ResponseTransmit     timestamp :  2023-01-22T12:43:57.547-05:00 }   { [-]     RequestID :  b74fab20-9a7b-11ed-bd70-c503548afa99     clientPathURI :  signup    }     level :  Info     logEventType :  RequestReceive     timestamp :  2023-01-22T12:43:57.496-05:00 } ... View more

Hello, I am trying to extract the below 201 text highlighted in red below as one separate field from two separate events. How may I do this? I attempted the field extraction feature in Splunk but had no luck. Any assistance is appreciated! Event 1: 106.51.86.25 [ 22/Dec/2022:07:48:10 -0500 ] POST /services/public/v1/signup HTTP /1.1 201 5 539   Event 2: 23.197.194.86 - - [22/Dec/2022:07:48:09 -0500] " POST /services/public/v1/signup HTTP/1.1" 201 - ... View more

Hello, I am very new to Splunk. I am wondering how to split these two values into separate rows. The "API_Name" values are grouped but I need them separated by date. Any assistance is appreciated! SPL:     index=... | fields source, timestamp, a_timestamp, transaction_id, a_session_id, a_api_name, api_name, API_ID | convert timeformat="%Y-%m-%d" ctime(_time) AS date | eval sessionID=coalesce(a_session_id, transaction_id) | stats values(date) as date dc(source) as cnt values(timestamp) as start_time values(a_timestamp) as end_time values(api_name) as API_Name by sessionID | where cnt>1 | eval start=strptime(start_time, "%F %T.%Q") | eval end=strptime(end_time, "%FT%T.%Q") | eval duration(ms)=abs((end-start)*1000) | stats count, perc95(duration(ms)) as 95thPercentileRespTime(ms) values(API_Name) as API_Name by date     ... View more

I have two events where in order to get a response time, I need to subtract the two timestamps. However, this needs to be grouped by "a_session_id" / "transaction_id." The two events I need are circled in red in the screenshot attached. I need those two events out of the three events. Every "a_session_id" has these three logs. source="/apps/logs/event-aggregator/gateway_aggregator_events.log" is always after source="/logs/apigee/edge-message-processor/messagelogging/gateway-prod/production/Common-Log-V1/14/log_message/gateway.json" Please let me know if you need more information. Such as snippets on the SPL. Any assistance is much appreciated! ... View more

Hello, I would like to extract the 10 milliseconds in the below snippet of text as a separate value in a field. Is there anyway to do this? Thank you!! 2022-10-02T12:56:40.073Z [ BillingExecutors-4 ] INFO com...els.kafka.ElsKafkaReceiver - Message processing time at event aggregator in milli seconds 10 2022-10-02T12:56:40.073Z  [ BillingExecutors-4 ] INFO com...els.kafka.ElsKafkaReceiver - Message processing time at event aggregator in milli seconds 10 ... View more

Hi,  I have two event fields with the same name "timestamp". I just want to display (in stats) the "timestamp" field from the "ResponseReceive" logEventType. Not the one from logType "SystemLog". Currently is displays both.  Is there a way to do this? Any assistance is appreciated. Thank you!! ... | fields timestamp, apiName, apiVersion, ceoCompanyId, entityId, sessionId, transactionDetailsResponse.transactionDetailsList.totalCount, transactionDetailsResponse.transactionDetailsList.transactionDetails{}.acctNumber, transactionDetailsResponse.transactionDetailsList.transactionDetails{}.Amount, transactionDetailsResponse.transactionDetailsList.transactionDetails{}.tranDateTime, transactionDetailsResponse.transactionDetailsList.transactionDetails{}.totalTranCount | rename transactionDetailsResponse.transactionDetailsList.totalCount AS "TransactionCount", transactionDetailsResponse.transactionDetailsList.transactionDetails{}.acctNumber AS "AcctNum", transactionDetailsResponse.transactionDetailsList.transactionDetails{}.Amount AS "Amount", transactionDetailsResponse.transactionDetailsList.transactionDetails{}.tranDateTime AS "TranDateTime", transactionDetailsResponse.transactionDetailsList.transactionDetails{}.totalTranCount AS "TotalTranCount" | stats values(timestamp) AS timestamp, values(TranDateTime) AS TranDateTime, values(apiName) AS apiName, values(apiVersion) AS apiVersion, values(ceoCompanyId) AS ceoCompanyId, values(entityId) AS entityId, values(TotalTranCount) AS TotalTranCount, values(AcctNum) AS AcctNum, by sessionId,     ... View more