|
Compare unique ID's to Create and Delete Times
I have thousands of lines a day of data I would like to sort out. Every sessions has the 3 lines below. I want to figure out each sessions length from Creation to Deletion. Every one has a unique session ID
logevent3:<190>Nov 20 08:41:06 000423df255c[4627]: 6|4096|RC|CAC: Created CAC session ID 0000019d1a5501ad7f32 due to Seachange server request|
logevent3:<190>Nov 20 09:06:15 000423df255c[4627]: 6|4145|RC|CAC: Terminated CAC session 0000019d1a5501ad7f32|
logevent3:<190>Nov 20 09:06:15 000423df255c[4627]: 6|4097|RC|CAC: Deleted session ID 0000019d1a5501ad7f32 due to Seachange server request|
logevent3:<190>Nov 20 08:09:13 000423df255c[4627]: 6|4096|RC|CAC: Created CAC session ID 000041df18d50268a8b9 due to Seachange server request|
logevent3:<190>Nov 20 09:39:41 000423df255c[4627]: 6|4145|RC|CAC: Terminated CAC session 000041df18d50268a8b9|
logevent3:<190>Nov 20 09:39:41 000423df255c[4627]: 6|4097|RC|CAC: Deleted session ID 000041df18d50268a8b9 due to Seachange server request|
So what I was thinking about if it's possible is to have. So for the above session it would look like
Session ID Create Time Delete Time Session Length
0000019d1a5501ad7f32 Nov 20 08:41:06 Nov 20 09:06:15 25:09 min
000041df18d50268a8b9 Nov 20 08:09:13 Nov 20 09:39:41 90:28 min
Some of these could be a couple hours in length as well
|