Hi,
Our application logs an event at the end of completion of an api call with response time in milliseconds(ms) like this <16ms>. I have already extracted the response time into field "ex_time" . we need to find the start time of the api call and assign it to a field possibly... where the start time is difference between log event timestamp (_time) and response time (ex_time). how can we achieve this ?
start_time = _time - ex_time
The start time should be in same format as the _time field.
Sample event --
[02/28/17 10:24:12.5387] DEBUG {14679}: <6189c8b7-59f9-4c63-bb91-6b1eb4435706>MilestonesAclManager.CheckPermissions(, "2") by dren.lock/Elapssecom/b7b05b47-c853-4dcd-9dd0-3dfab3c2cf77. ,<16ms>
Any hints and help appreciated.
Thanks
The _time is a special field whose underlying values is in epoch format. Give this a try
your base search | eval start_time=_time-(ex_time/1000) | convert ctime(start_time)
You can also specify your own format like this
your base search | eval start_time=_time-round(ex_time/1000,4) | convert ctime(start_time) timeformat="%m/%d/%y %H:%M:%S.%4N")
When sending a post including code, be sure to mark it as code with the button that say 101 010. That will keep the interface from treating pieces of it as html and format instructions.
What part of your sample event is the elapsed ms?
The _time is a special field whose underlying values is in epoch format. Give this a try
your base search | eval start_time=_time-(ex_time/1000) | convert ctime(start_time)
You can also specify your own format like this
your base search | eval start_time=_time-round(ex_time/1000,4) | convert ctime(start_time) timeformat="%m/%d/%y %H:%M:%S.%4N")
Thanks SomeSoni. the second one worked as expected.