Splunk Search

how to get number of concurrent sessions per minute

Laya123
Communicator

Hi ,

How to get number of concurrent sessions per minute. My transaction started with beginning session and ends with ending session

for example

my first transaction started at 12-3-2015 10:01:00, second transaction started at 12-3-2015 10:01:10, third transaction started at 12-3-2015 10:01:35, fourth transaction started at 12-3-2015 10:02:15, fifth transaction started at 12-3-2015 10:02:40

My second transaction ended at 12-3-2015 10:01:50

I want my output like

12-3-2015 10:01:00 - number of transactions 3
12-3-2015 10:02:00 - Number of transactions 4 (second transaction completed in last minute only thats why I excluded that in next minute)

Thanks in advance

Tags (2)
0 Karma
1 Solution

fdi01
Motivator

try like this:

...| transaction startswith="beginning session" endswith="ending session" |bucket span=1m _time|stats count as "number of transactions" by _time

or

 ...| transaction startswith="beginning session " endswith="ending session " | timechart per_minute(eval(count)) as "number of transactions"

View solution in original post

0 Karma

fdi01
Motivator

try like this:

...| transaction startswith="beginning session" endswith="ending session" |bucket span=1m _time|stats count as "number of transactions" by _time

or

 ...| transaction startswith="beginning session " endswith="ending session " | timechart per_minute(eval(count)) as "number of transactions"
0 Karma

stephane_cyrill
Builder

Hi here is something for you.

1.
source="" | transaction startswith="beginning session "
endswith="ending session " |timechart count span=1m as
"number of transactions"

However if this returns more than 50,000 results it
wont work and it'll return that bucketing error.

OR

2.
source="" | transaction startswith="beginning session "
endswith="ending session " |eval count=1
| timechart per_minute (count) as
"number of transactions"

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...