How to get the difference between two time epochs in logs after correlating them

[haaandnt]

Hello there,

If this is what you wanted, follow the steps :

*Logs used :

Use this query to get only the logs that has the label STATUS, and only the values START and END :

{job="test"} |= "STATUS" |~ "START|END" | pattern `<DATE> TID=<TID> EXPID=<EXPID> TASK=<TASK> STATUS=<STATUS> EPOCH=<EPOCH>`

Then, do these transformations :

1. Extract the labels to field.
2. Group by the IDs and get the “All values” of the EPOCH, STATUS and the "Last
   value of the DATE (“Last” is the date of the task with STATUS=START).

3. Filter out the lines to retain only the tasks that succeeded (have both END and START status).

4. Extract the epoch array to fields.
5. Calculate the diff between the epochs (“0” is the END, “1” is the START).
6. Filter out the unnecessary fields.

Hope this helps!