Getting Data In

Transaction using timestamp

Sriram
Communicator

I have the following query.
index="someindex" | sort +evnt_ts | transaction dcn,evnt_ts keepevicted="t"| table dcn,_time,evnt_ts

There are 15 events for each dcn. When I do 'transaction dcn', I get the results properly with evnt_ts grouped together. I need to results come in ascending time sequence as I want to use 'delta' command to find the time difference between each events. When I run the above query, the timestamp is always in reverse order (most recent time first). I even tried |reverse. Nothing works. Any luck.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Have you tried '... | sort -evnt_ts | ...'?

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Have you tried '... | sort -evnt_ts | ...'?

---
If this reply helps you, Karma would be appreciated.

Sriram
Communicator

Yes. I got the same result with event_ts, how sort using _time helped.I managed to make it work by specifying "startwith" as well as with those sort as there are many similar transaction with same dcn. Thanks again.

index="someindex" | transaction dcn startswith="020"| eval "Response Time(Secs)" = round(duration,2) | eval "Event Time"=strftime(_time, "%m-%d-%Y %H:%M:%S") | rename rcvd_dt as "Received Date" dcn as DCN | table "Event Time", "Received Date" , DCN, , "Response Time(Secs)" | sort -"Event Time"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...