All Apps and Add-ons

Sankey Diagram - Custom Visualization: One event in multiple transactions

sosapes
New Member

I have events by this pattern:
time id state

e.g.:
2017-03-10 10:30:00 123 A
2017-03-10 10:30:01 123 B
2017-03-10 10:30:02 123 C
2017-03-10 10:30:03 123 D

What i can get with "| transaction id"
A B duration
C D duration

For Sankey diagram need to transform them into pattern

e.g.:
A B duration
B C duration
C D duration

In shortcut I need one event to be in two transactions. Is there some trick to achieve this?

0 Karma

Richfez
SplunkTrust
SplunkTrust

The streamstats command should do what you need here.

Specifically, you'll want to use it with a window=2 and use the first and last stats function to pull out your times ( _time) or values to create a duration.

You'll want something like

... my search here ...
| streamstats window=2 first(_time) AS first_time, last(_time) AS last_time, first(<fieldname>) as first_val, last(<fieldname>) as last_val
| eval duration = first_time - last_time

Where you replace with whatever gave you the field with values "A", "B", and so on.

Here's a run-anywhere as an example. In it I create a fake "nums" that I use - that's the first 4 lines. You'll want to start with the streamstats right after you have your data.

| makeresults 
| eval nums="3 7 8 12 15 19" 
| makemv delim=" " nums 
| mvexpand nums 
| streamstats window=2 last(nums) AS oldest first(nums) AS newest 
| eval duration=oldest-newest

The resulting output will hopefully be easily adaptable to your own needs.

0 Karma

sosapes
New Member

Thank you it helped find me a way!

0 Karma

Richfez
SplunkTrust
SplunkTrust

Excellent!

It would be very useful to those who stumble across this answer later if you could provide the search you ended up with here and mark the question as accepted.

Second best (and good enough) is just clicking "Accept" so everyone knows there's a valid answer!

Thanks! And glad we could help!

-Rich

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...