I have a log file going to Splunk which indicates the start and end of an event for VM creation. For example, in the logs I see something like this:
6/15/2015 11:00:00 <unique ID 1> Start event
... other events...
6/15/2015 11:02:00 <unique ID 1> End event
... other events...
6/15/2015 11:04:00 <unique ID 2> Start event
... other events...
6/15/2015 11:05:00 <unique ID 2> End event
I want to be able to get the time difference between the start and end event for all unique events as given by "unique id X".
Another way of saying it is, for all unique ID's, do eval(endtimestamp - starttimestamp), and print out the time difference in table form. I'm struggling to figure out how to do this through Splunk though. Can anyone point me in the right direction?
... View more