How to write a search to calculate the response time from my two sample events?

[karthi2809]

12/16/16
6:09:57.022 AM  
[2016-12-16 06:09:57,022][LOG ][WARN ] transid=xxx; Path=PQ; OperationName=UP; TransactionStatus=SUCCESS; CaptureLocation=Response

12/16/16
6:09:56.863 AM  
[2016-12-16 06:09:56,863][LOG ][WARN ] transid=xxx; Path=PQ; OperationName=UP; RequestPayload=U-900M87282; CaptureLocation=Request

[niketn]

Try the following stats command. You should filter/join results in your base search (i.e. if Path and OperationName have static values, then use the values in place of asterix *.

Duration is calculated as the difference between earliest and latest events matched by the stats command containing both Request and Response. It is in seconds which you can change to other time format as per your need. Second search can be used to set conditions based on various scenarios like eventcount=1 implies only request no response.

 <Your Base Search> "[LOG ][WARN ]" (CaptureLocation="Request" OR CaptureLocation="Response") Path=* OperationName=* 
    | stats count as eventcount earliest(_time) as earliesttime latest(_time) as latesttime values(TransactionStatus) as TransactionStatus values(RequestPayload) as RequestPayload values(CaptureLocation) as CaptureLocation by transid, Path, OperationName 
    | search eventcount>1 AND TransactionStatus= "SUCCESS" AND CaptureLocation="Request" AND CaptureLocation="Response" 
    | eval duration=latesttime-earliesttime 
    | eval earliesttime=strftime(earliesttime,"%Y/%m/%d %H:%M:%S,%3N") 
    | eval latesttime=strftime(latesttime,"%Y/%m/%d %H:%M:%S,%3N")

PS: Depending on the use case if there is always Request first and Only one Response per transaction ID you can also set eventcount=2 in the inner search condition.

[somesoni2]

Try this

your base search CaptureLocation=Response OR CaptureLocation=Request
| chart max(_time) over transid over CaptureLocation
| eval Response_Time=Response-Request

OR

your base search CaptureLocation=Response OR CaptureLocation=Request
| transaction transid startswith="CaptureLocation=Request" endswith="CaptureLocation=Response"
| rename duration as Response_Time

[richgalloway]

What is your question?