Getting Data In

How to calculate the difference between timestamps?

skoelpin
SplunkTrust
SplunkTrust

I have a lot of SOAP request/response pairs indexed in Splunk. One of those are CalculateTaxRequest and CalculateTaxResponse. So when the call is made it will show 23:59:04,108 and 23:59:04,437 respectfully (hour/minute/second/millisecond). I have created a new field called TimeStamp which extracts the time for each call. I then wrote a search for ...|transaction maxevents=2 and assigned another field (GUID) which matches the unique identifiers for the request/response in one field.

My current query is:

index=all  GUID="*" AND *calculatetax*   Timestamp="*" | transaction maxevents=2 

This search returns the request and response for calculatetax in the same field along with returning the timestamp for both fields. So now I would like to take those 2 timestamps and subtract them and have another field output the difference between the two in the same field. I'm doing this so I don't have to manually calculate the difference and see which services too longer then the others. Thanks in advance!

Tags (2)
0 Karma

wpreston
Motivator

Transaction automatically creates a field called duration that is the difference between the earliest and latest events in the transaction. If your Timestamp field is the same as the _time field in each event, the work is already done for you.

Just a side note, I'd recommend beefing up your transaction definition so that you can ensure the events that are paired together actually go together. By default, transaction combines events based on time, so if you have two CalculateTaxRequests start one after another, they could be combined into a transaction and your statistics would be off. Perhaps a transaction definition like this?

index=all  GUID="*" AND *calculatetax*   Timestamp="*" | transaction GUID startswith=CalculateTaxRequests endswith=CalculateTaxResponse  maxevents=2
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...