Splunk query for time difference between 2 log statements

Question

I have 2 methods that logs message ID. The first method is JMS producer and the second method is JMS consumer. When messages are in the queue for a long time, then I need to print the message ID that were in the queue for more than 20 seconds.

 Log statements:

JMSProducer: MessageId=123
JMSProducer: MessageId=456

JMSConsumer: MessageId=123
JMSConsumer: MessageId=456

Using the timestamp at which they get logged, I need to run a report to give me the timestamp difference greater than 20 seconds.

How do I write a Splunk query for it?

The output should be message ID and timestamp difference in milliseconds or seconds.

Answer 1

Use transaction to tie the two log messages together, and it will give you a duration field.

search here | transaction MessageId | where duration > 20 | | transaction MessageId | where duration > 20 | other operations here such as stats