Query for calculating duration between two different logs in Splunk

问题

As part of my requirements, I have to calculate the duration between two different logs using Splunk query. For example:

Log 2: 2020-04-22 13:12 ADD request received ID : 123

Log 1 : 2020-04-22 12:12 REMOVE request received ID : 122

The common String between two logs is " request received ID :" and unique strings between two logs are "ADD", "REMOVE". And the expected output duration is 1 hour.

Any help would be appreciated. Thanks

回答1:

You can use the transaction command, https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction

Assuming you have the field ID extracted, you can do

index=* | transaction ID

This will automatically produce a field called duration, which is the time between the first and last event with the same ID

回答2:

While transaction will work, it's very inefficient

This stats should show you what you're looking for (presuming the fields are already extracted):

(index=ndxA OR index=ndxB) ID=* ("ADD" OR "REMOVE")
| stats min(_time) as when_added max(_time) as when_removed by ID
| eval when_added=strftime(when_added,"%c"), when_removed(when_removed,"%c")

If you don't already have fields extracted, you'll need to modify thusly (remove the "\D^" in the regex if the ID value isn't at the end of the line):

(index=ndxA OR index=ndxB) ("ADD" OR "REMOVE")
| rex field=_raw "ID \s+:\s+(?<ID>\d+)\D^"
| stats min(_time) as when_added max(_time) as when_removed by ID
| eval when_added=strftime(when_added,"%c"), when_removed(when_removed,"%c")

来源：https://stackoverflow.com/questions/61358636/query-for-calculating-duration-between-two-different-logs-in-splunk