How do you calculate time taken by process with date and generate a report from it where input is a log file?

[shubhambhagat02]

My log file is like
02/04/2018 - 06:27:23 --- process 1 started
02/04/2018 - 06:28:23 --- process 1 completed
02/04/2018 - 06:28:23 --- backup initiated
02/04/2018 - 06:30:23 --- mail sent
02/04/2018 - 06:31:23 --- 'back up completed

I want to calculate time taken by " backup initiated" to "back up completed" with date. I want to generate a report for date and time taken by the process.

[renjith_nair · Accepted solution]

@shubhambhagat02

If you do not have a common field for each events to denote a start//finish, try using transaction

your searches | transaction startswith="backup initiated" endswith="back up completed" maxspan=10m

Above gives you a "duration". Maxspan should be changed according to your process durations

OR

If there are only two events in a day, then set the time rande to that day and

search "backup*"|stats earliest(_time) as backup_start_time,latest(_time) as backup_end_time|eval duration=backup_end_time-backup_start_time