Hi
So I have logs indexed in spunk that describe several steps in a workflow. The logs contain information on many tasks that make up this workflow. Each task is given a unique Task_ID. They looks a bit like this…
Time | TaskID | TaskStatus |
2012-04-25 12:23:34 | [1343077113556] | StartEncodeTask |
2012-04-25 01:13:14 | [1343214875758] | StartCopyTask |
2012-04-25 01:21:22 | [1343412154542] | StartMoveTask |
Time | Task_ID | Task_Status |
2012-04-25 12:29:14 | [1343077113556] | TaskComplete |
2012-04-25 01:14:36 | [1343214875758] | TaskComplete |
2012-04-25 01:22:41 | [1343412154542] | TaskComplete |
The only thing linking the start task to the end task is the "TASK_ID"
So my issue is how can I get spunk to spit out the # of Successful Completed Tasks for each Task type in a given hour period AND on average how long did each task type take to complete?
e.g.
TASK | #COMPLETED | AVG TIME TO COMPLETE |
EncodeTask | 241 | 2min41sec |
Any help with this would be terrific.
A good start might be using the transaction command.
... | transaction Task_ID
You'll have a duration of the overall transaction and you can specify what an expected transaction should start and end with. You'll find quite a few transaction questions on splunkbase.
http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Searchfortransactions?r=searchtip
Previous splunkbase answer:
A good start might be using the transaction command.
... | transaction Task_ID
You'll have a duration of the overall transaction and you can specify what an expected transaction should start and end with. You'll find quite a few transaction questions on splunkbase.
http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Searchfortransactions?r=searchtip
Previous splunkbase answer: