Splunk Search

Time Duration between each session

rajgowd1
Communicator

Hi,
we have few micro services which are running on pivotal.i would like find the time duration from starting to end flow based on session id.

i got few values for 1 minute duration,which has the same session id but different end points and micro services.

attaching the file which has some fields and values.
link text

Tags (1)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try

your base search | stats min(_time) as start max(_time) as end by cf_session_id | eval duration=end-start | convert ctime(start) ctime(end) | eval duration=tostring(duration,"duration")

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try

your base search | stats min(_time) as start max(_time) as end by cf_session_id | eval duration=end-start | convert ctime(start) ctime(end) | eval duration=tostring(duration,"duration")
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...