Parse time by combining logs

Follow

Unknown

• March 29, 2019 12:56

I wanted to find the time between two request. So in the attach picture I have two request i.e. Entering Request and Exiting Request with two different time i.e. 07:40:56.865 and 07:45:57.298 and they are coming from same Host i.e. 10.18.88.68.
So I wanted to find the time stamp between Entering request and exiting request and if it greater than 5 seconds then it will alert. Please see screen shot for log

 

 

0

• 

  Azriel Nguyen

  • April 02, 2019 17:16

  Try this Sachin,

  | toMillis(parseDate(enter_time, "HH:mm:ss.SSS")) as enterMillis
  | toMillis(parseDate(exit_time, "HH:mm:ss.SSS")) as exitMillis
  | exitMillis - enterMillis as diffMillis
  | diffMillis * .001 as diffSeconds
  | diffSeconds / 60 as diffMinutes
  | where diffMinutes > 5

  0

  Comment actions Permalink

Please sign in to leave a comment.