10/18/2013 1:49:51 Message: IP Address : xxxx Message2: Message1 (first process starts)
10/18/2013 1:49:51 Message: Other_Message2
10/18/2013 1:50:52 Message: Other Message3
10/18/2013 1:50:52 Message: Other Message4
10/18/2013 1:51:51 Message: Other_Message2
10/18/2013 1:52:52 Message: Other Message31
10/18/2013 1:53:52 Message: Other Message22
10/18/2013 1:54:52 Message: Other Message2
10/18/2013 1:55:53 Message: Other Message2 (end of the 1st process)
10/18/2013 2:55:51 Message: IP Address : xxxx Message2: Message1 (Second Event Starts)
My app log file looks like that. I need to get the time value between the first message and last message which is same as first one except timestamp it shows. I can't use Transaction method as you can see Message2 occurs several times between those two events. Any ideas for the solution? I m a newbie splunker, I m appreciated for the any comments.
Try this.
your base search | rex "(?i)^(?:[^ ]* ){2}(?P<raw_data>.+)" | transaction raw_data
you can add filters in your base search to just select first and last event (from the example).
You could potentially rex the IP address and then use transaction on that.
Try this.
your base search | rex "(?i)^(?:[^ ]* ){2}(?P<raw_data>.+)" | transaction raw_data
you can add filters in your base search to just select first and last event (from the example).
You could extract the to-be-identical message into a field, and do this:
... | stats range(_time) as duration by message_field
Then you're looking for transaction
. That allows you to specify spans of and pauses between transactions.
approach is nice, but this time interval will occur maybe 100 times in the log. I m trying to get some data like lets say, daily average of time it was spend.