Splunk Search

How do I extract timings from chained events using start and end times

pbunce1
Explorer

We have the following events (dots represent other events for clarity) and would like to extract on a per process basis the duration of how long each took (using the start and end time of each process that has been logged and loaded as events)

What would be the best approach to do this, do I need to use txns and specify startwith and endswith and how would I then pull in all process times assuming there will be multiple as per below example (as in what type of syntax to use for this search) - not too worried about result format for now, would just like to understand preferred approach to use for this - many thanks!!!

Sample Events:

11:51:10 - ‘Process 1 Start’

11:52:11 – ‘Process 1 Finish’

11:53:12 – ‘Process 2 Start’

11:54:15 – ‘Process 2 Finish’

….


hence would like to extract:

Process 1 Duration: 61 secs

Process 2 Duration: 63 secs

Tags (1)
1 Solution

kristian_kolb
Ultra Champion

Two ways as I see it (assuming that you have the Process ID extracted into a field called process_id😞

either transaction, where the duration is automatically calculated;

... | transaction process_id | ...

or use stats, which should be more efficient;

... | stats min(_time) AS min_time max(_time) AS max_time by process_id | eval duration = max_time - min_time | ...

Hope this helps,

Kristian

View solution in original post

kristian_kolb
Ultra Champion

Two ways as I see it (assuming that you have the Process ID extracted into a field called process_id😞

either transaction, where the duration is automatically calculated;

... | transaction process_id | ...

or use stats, which should be more efficient;

... | stats min(_time) AS min_time max(_time) AS max_time by process_id | eval duration = max_time - min_time | ...

Hope this helps,

Kristian

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...