Refine your search:

Is there some kind of wierdness with mulit-value transaction fields where you can't run operatoins on them? For example, if I put the eval before the tranaction, it ends up in the table, but if I put it after(second example), no dice. And since the delta sits downstream of the transaction, it's not getting anything as you can see by the empty TimeWait column with spider webs and tumbweeds in it

index=* sourcetype="oraclehotobject4" OraInst=2| eval OTime= tonumber(OraTimeWaited) | transaction OraObjID OraEvent keepevicted=true mvlist=true | delta(OTime as TimeWaited) p=1 | table OraTimeStamp OraObjID OraEvent OraObjName OraTimeWaited OTime TimeWaited duration

sourcetype="oraclehotobject4" OraInst=2 | transaction OraObjID OraEvent keepevicted=true mvlist=true | eval OTime= tonumber(OraTimeWaited)| delta(OTime as TimeWaited) p=1 | table OraTimeStamp OraObjID OraEvent OraObjName OraTimeWaited OTime TimeWaited duration

This ONLY happens with the mulit-line/event transactions as you see below. <xxx> is the missing OTime (I had to cast that to a number). So it seems like OraTimeWaited is not making it out of the multi-event transaction, so, I can't do a delta on them.

If I use anything other then mvlist=true, I don't get proper transactions.

OraTimeStamp ObID Event Object OraTimeWaited OTime TimeWaited Duration
12-30-2011 01:37 119525 sequential read ERRORS_N1 9635 9635 0

12-30-2011 01:37 123669 db file write ERRORS_N1 9635 <xxx> <spiderweb> 240 12-30-2011 01:41 123669 db file write ERRORS_N1 9635 <xxx> <tumbleweed>

Thanks!

asked 04 Jan '12, 15:05

indigo42's gravatar image

indigo42
1
accept rate: 0%

Be the first one to answer this question!
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×197

Asked: 04 Jan '12, 15:05

Seen: 685 times

Last updated: 04 Jan '12, 15:05

Copyright © 2005-2014 Splunk Inc. All rights reserved.