I have log file like this:
deal - 123456 - notification receives from web -- Time 10:46:42
deal - 123456 - publishing xml -- Time 10:46:43
deal - 789012 - notification receives from web -- Time 10:46:45
deal - 123456 - SAVED ack -- Time 10:46:46
deal - 123456 - publishing xml -- Time 10:46:49
deal - 789012 - SAVED ack -- Time 10:46:52
deal - 123456 - SAVED ack -- Time 10:46:58
I want to create field called deal id
(for ex: 123456) and grab first line and create a field called dealcreatedtime
(Time 10:46:42)
Then, I want to join or do a transaction with this (4th line) line
deal - 123456 - SAVED ack -- Time 10:46:46. to create a field called Dealsavedtime
.
So, I want to check how long it took to grab the same deal.
Can you please help to get the logic? I tried join and subsearch, but subsearch is grabbing both lines like below and affecting results. I tried to use tail in subsearch, but did not work.
deal - 123456 - SAVED ack -- Time 10:46:46
deal - 123456 - SAVED ack -- Time 10:46:58
Assuming the event always ends with "SAVED ACK" you can use transaction and look at the duration. You need to extract that deal number as a field..
... | rex fields=_raw "deal - (?<deal_id>\d+)\s" | transaction deal_id endswith="SAVED ack" | table deal_id duration
Assuming the event always ends with "SAVED ACK" you can use transaction and look at the duration. You need to extract that deal number as a field..
... | rex fields=_raw "deal - (?<deal_id>\d+)\s" | transaction deal_id endswith="SAVED ack" | table deal_id duration
Hi,
If you want the first acknowledgement (10:46:46) to be considered ignoring second (10:46:58). In sub search join you can filter using SAVED ACK and then do
..filter using "SAVED ACK"|sort by Time|convert dur2sec(Time) as TimeSec|eventstats min(TimeSec) as minTimeSec by dealId|where TimeSec==minTimeSec
above subsearch will return all the first SAVED ACKs.
You need to handle Day jump scenario by adding or negating 86400 to Time.