In my logs, I have some events like:
time1 eventStart
time2 eventFinish
time3 eventStart
time4 eventFinish
time5 eventStart
time6 eventFinish
I want to get the time difference between start and finish event.
So, the result should be 3 rows, having time diff between: time2-time1, time4-time3, time6-time5
Can you please help?
Hi, were you able to figure this out?
Can you provide us your query and some sample data?
You need to group the events together using the Transaction command.. So if you have your eventStart as a seperate event from your eventFinish then the transaction command will group them both as 1 event then you can find the duration
So it would look something like this
.. | transaction startswith="eventStart" endswith="eventFinish" | timechart avg(duration)
Look at using transaction command