Here's my search string:
host=abc* source="/log...*" | rex "^[\d|-]+ [\d|:|,]+ (?P<Identifier>[\w\w|_]+)\s" | transaction Company startswith="HelloPhrase" endswith="GoodbyePhrase" | timechart useother=F avg(eval(duration/60)) by Identifier
Within the start/end events, I want to parse and then extract the max of a number that appears within another event and additional information provided there. I've tried to illustrate what I'm looking for...
StartEvent...
Event1 [Number 1, processing size 100]...
Event2...additional information
Event45 [Number 7, processing size 50]...
EndEvent
I want to know how long it takes to complete the task and what the max number is along with the processing size of that event. Any suggestions would be greatly appreciated.
Look at the automatic fields populated by the transaction :
- duration
- eventcount
see http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction
If you want to also distinguish all the values for the events, the individual fields will be turned into multivalue fields,
you can use the multivalue functions like mvcount()
see http://docs.splunk.com/Documentation/Splunk/latest/Search/Parsemultivaluefields
Hmm some more information, incl sample events would probably be helpful.
For a transaction, the duration
field is calculated automatically. Assuming that you extract "Number" as in your pseudo events, somthing like the following to replace the timechart
part;
... | stats max(Number) first(duration) by _time
/K