Splunk Search

Transaction by source, sourcetype, day

sanjay_shrestha
Contributor

Following query has been used to calculate duration for individual source (input files) for last 5 days:

index="my_index" earliest=-5d  latest=now| transaction source maxevents=-1 | eval day=strftime(_time,"%m/%d/%Y")| sort - day sourcetype| table day,sourcetype,source,duration 

Only transaction by source is used, hoping it would capture all the input files which have unique file name, thus separating its sourcetype and date.

Basically, just need to display duration per individual source file per sourcetype per day.

Thanks,

Sanjay

Tags (1)
0 Karma
1 Solution

lguinn2
Legend

There is a much more efficient way to do this:

index="my_index" earliest=-5d  latest=now
| eval day=strftime(_time,"%m/%d/%Y")
| stats range(_time) as duration by day sourcetype source
| eval duration=tostring(duration,"duration")

This is faster and more scalable.

View solution in original post

lguinn2
Legend

There is a much more efficient way to do this:

index="my_index" earliest=-5d  latest=now
| eval day=strftime(_time,"%m/%d/%Y")
| stats range(_time) as duration by day sourcetype source
| eval duration=tostring(duration,"duration")

This is faster and more scalable.

sanjay_shrestha
Contributor

Thanks. It worked better that using transaction.

0 Karma

sanjay_shrestha
Contributor

It worked by adding keepevicted=true to transaction command.

0 Karma

aholzer
Motivator

Now the above simply answers your question. I'm sure that there is a more efficient way of going about doing what you need, but I currently don't have time to work on it 😛

Hope the above helps.

0 Karma

aholzer
Motivator

Because you have no limit to the number of events in your transaction, and because you have no start and end points for your transactions, and furthermore you have nothing limiting the transactions other than "source", then you are going to get 1 event (transaction) per source value you have.

You should calculate the day first, then use the day together with the source in your transaction. Like so:
index="my_index" earliest=-5d latest=now | eval day=strftime(_time,"%m/%d/%Y") | transaction source day maxevents=-1 | sort - day sourcetype| table day,sourcetype,source,duration

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...