Splunk Search

create table and calculate time

jangid
Builder

My log file is similar to below and search is

I0530 14:28:10.394402 29432 tafc_logger_c.cpp:42] demoprogram.b:9 [manoj] [MYCOMP] [DEMO] End Transaction - End Message
...
...
I0530 14:28:06.406689 29432 tafc_logger_c.cpp:42] demoprogram.b:2 [manoj] [MYCOMP] [DEMO] Start Transaction - Some Message

Now I have two question
1. How to convert this log information in to table?

Table format should be like this

Date Time User Component Message

  1. How to calculate time difference between two events?

from above log I want to calculate time difference

Transaction Time = 0530 14:28:10.394402 - 0530 14:28:06.406689

Thanks

Tags (2)
0 Karma
1 Solution

jangid
Builder

Below query solve my problem

earliest=06/06/2012:15:30:00 "START TRANSACTION" OR "STOP TRANSACTION" | table _time | streamstats range(_time)

View solution in original post

0 Karma

jangid
Builder

Below query solve my problem

earliest=06/06/2012:15:30:00 "START TRANSACTION" OR "STOP TRANSACTION" | table _time | streamstats range(_time)

0 Karma

jangid
Builder

no nothing extracted

0 Karma

kristian_kolb
Ultra Champion

Are the fields (User, Component, Message) already extracted?

Does Splunk parse your timestamps correctly?

If yes, this is simple

/k

0 Karma

yannK
Splunk Employee
Splunk Employee

1 - make sure that the timestamp is correctly extracted in splunk at index time
see how to define a sourcetype http://docs.splunk.com/Documentation/Splunk/4.3.2/Data/Configuretimestamprecognition
it will be stored on the field _time.

2 - at search time, extract the other fields, using regex, inline extraction or automatic extractions.
see http://docs.splunk.com/Documentation/Splunk/4.3.2/Knowledge/Addfieldsatsearchtime

example of inline extraction
mysearch | rex "[(?\w+)] [(?\w+)] [(?\w+)]" | table _time field1 field2 field3

3 - define a transaction to group your events and calculate duration.
example http://docs.splunk.com/Documentation/Splunk/4.3.2/SearchReference/Transaction
mysearch | rex "[(<?field1>\w+)] [(<?field2>\w+)] [(<?field3>\w+)]" | transaction field1 field2 field3 | table _time duration field1 field2 field3

Beware an unfinished transaction will not have a valid duration.
Regards

kristian_kolb
Ultra Champion

Try to follow the instructions provided by yannk. That's pretty much how it's done.

/k

0 Karma

jangid
Builder

I am forwarding data from universal forwarder and everything is default

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...