I have a database that stores a separate event every time someone starts or stops a task. This should be a simple task, but I cant seem to figure out how to go about the calculation. There are three things I need to account for: accepting the task, abandoning the task, and completing the task. I only want to calculate the time it takes between each user's accepting a task and completing it. If they abandoned it, then I don't want splunk to calculate the time
This is working off of timestamps and the fields user_name and action
action=0 for accepting
action=1 for completing
action=2 for abandoning
Any suggestions as to how I would go about this calculation?
EDIT: My supervisors loved it, but now they want me to cut out times when the users are not logged in. I asked around, and got a nice addition to the logs: total_login_time, which, as it's so simply named, is a simple record, in milliseconds, of how long the users have been logged in to the site. Can I still use transaction? Or do I need to change it entirely?
+1 on using transaction, but using action
as the correlating field won't work as it is changing within the session. user_name
seems more appropriate. Also perhaps specify the conditions a bit more so that it's the actual action
field that is checked for the values 0 and 2:
... | transaction user_name startswith=eval(action=0) endswith=eval(action=2)
This is exactly what I was looking for!
Great Stuff Ayn. Thanks. Give the points to Ayn!
+1 on using transaction, but using action
as the correlating field won't work as it is changing within the session. user_name
seems more appropriate. Also perhaps specify the conditions a bit more so that it's the actual action
field that is checked for the values 0 and 2:
... | transaction user_name startswith=eval(action=0) endswith=eval(action=2)
Yes, I did have to change it around a bit. The resulting search string looks a bit like this:
index=task_data task="*" NOT action="2" | transaction user_name startswith="action=0" endswith="action=1" maxevents="2" | where duation>0 | stats count by duration, task_name | fields task_name, duration |sort -duration |rename task_name AS "Task Name"
and it's giving me fairly nice results.
on an unrelated note, I love your picture. That game was really fun.
I would recommend that you take a look at the "transaction" command. It has a built in field called "duration". Here is an example of how to use it.
source="your data" | transaction action beginswith="0" endswith="2"
You might need to experiment with the maxspan and maxpause as well.
Here is a link to more information:
http://docs.splunk.com/Documentation/Splunk/4.2.5/SearchReference/Transaction
That's giving me some very nice results!
Thank you!