Splunk Search

Determining count and duration between eventtypes

marquiselee
Path Finder

Hi

So I have logs indexed in spunk that describe several steps in a workflow. The logs contain information on many tasks that make up this workflow. Each task is given a unique Task_ID. They looks a bit like this…

Time TaskID TaskStatus
2012-04-25 12:23:34 [1343077113556] StartEncodeTask
2012-04-25 01:13:14 [1343214875758] StartCopyTask
2012-04-25 01:21:22 [1343412154542] StartMoveTask

I've created Eventtypes to Identify when these Tasks Begin. e.g. eventtype="EncodeStart" I also have identified when ANY task completes… However there is no indication of the type of task that was completed. I've made an eventtype called 'TaskComplete' to identify these.

Time Task_ID Task_Status
2012-04-25 12:29:14 [1343077113556] TaskComplete
2012-04-25 01:14:36 [1343214875758] TaskComplete
2012-04-25 01:22:41 [1343412154542] TaskComplete



The only thing linking the start task to the end task is the "TASK_ID"

So my issue is how can I get spunk to spit out the # of Successful Completed Tasks for each Task type in a given hour period AND on average how long did each task type take to complete?

e.g.


TASK
#COMPLETED AVG TIME TO COMPLETE

EncodeTask
241 2min41sec




Any help with this would be terrific.

Tags (3)
0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

A good start might be using the transaction command.

... | transaction Task_ID

You'll have a duration of the overall transaction and you can specify what an expected transaction should start and end with. You'll find quite a few transaction questions on splunkbase.

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Searchfortransactions?r=searchtip

Previous splunkbase answer:

http://splunk-base.splunk.com/answers/4381/can-splunk-help-me-further-analyzerefine-the-durations-of...

View solution in original post

sdaniels
Splunk Employee
Splunk Employee

A good start might be using the transaction command.

... | transaction Task_ID

You'll have a duration of the overall transaction and you can specify what an expected transaction should start and end with. You'll find quite a few transaction questions on splunkbase.

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Searchfortransactions?r=searchtip

Previous splunkbase answer:

http://splunk-base.splunk.com/answers/4381/can-splunk-help-me-further-analyzerefine-the-durations-of...

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...