Splunk Search

How to generate a search that will show the time between REQ and ACK?

prashanthberam
Explorer

Hi,

Anyone, please help me. I need to find out the time between REQ and ACK by using the (TS:1478717835696) and Data Collection Node (DCN). But am trying to find out by using the transaction command but i haven't get the exact results.

My code is like this and also i need to find out the outcome status.

2016-11-09 12:57:18,855 VendorAdjudicationModule ERROR CorrelationID=2469bae9-fe14-4e67-b345-95d652f4a868 -[DCN xxxxxxxxxxxxxxx-SL:5-TS:1478717835696]: Group=000142003,Section=0001,PlanID=7154,State=TX1,ClaimType=0,VendorName=CVP,InvocationType=REQ

2016-11-09 12:57:18,855 VendorAdjudicationModule ERROR CorrelationID=2469bae9-fe14-4e67-b345-95d652f4a868 -[DCN xxxxxxxxxxxxxxx-SL:5-TS:1478717835796]: Group=000142003,Section=0001,PlanID=7154,State=TX1,ClaimType=0,VendorName=CVP,InvocationType=ACK,Outcome=SUCCESS

2016-11-09 12:57:18,855 VendorAdjudicationModule ERROR CorrelationID=2469bae9-fe14-4e67-b345-95d652f4a868 -[DCN xxxxxxxxxxxxxxx-SL:5-TS:1478717835800]: Group=000142003,Section=0001,PlanID=7154,State=TX1,ClaimType=0,VendorName=CVP,InvocationType=RSP,Segment =100

Anyone, please help me.

Thanks.

0 Karma
1 Solution

gokadroid
Motivator

If TS and DCN can uniquely identify one session (transaction) then can you try this:

index=yourIndex sourcetype=yourSourcetype "InvocationType=REQ" "InvocationType=ACK"
| rex field=_raw "\-\[(?<dcn>[^\-]+)\-(?<ts>[^\]]+)\]"
| transaction ts, dcn
| table dcn, ts, duration

This assumes all your timestamps are of same format. If they are of different format then probably it will require formatting first and then transaction command.

View solution in original post

gokadroid
Motivator

If TS and DCN can uniquely identify one session (transaction) then can you try this:

index=yourIndex sourcetype=yourSourcetype "InvocationType=REQ" "InvocationType=ACK"
| rex field=_raw "\-\[(?<dcn>[^\-]+)\-(?<ts>[^\]]+)\]"
| transaction ts, dcn
| table dcn, ts, duration

This assumes all your timestamps are of same format. If they are of different format then probably it will require formatting first and then transaction command.

prashanthberam
Explorer

Thanks it works perfectly....

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...