Splunk Search

Time difference for the transaction

splunkpoornima
Communicator

I want to find the time difference between the transactions,display as a chart

My data will look like this

Mon Sep 24 11:00:30 CDT 2012,xxx,START

Mon Sep 24 11:00:31 CDT 2012,xxx,COMPLETION: Succeeded

so what i need is (11:00:30-11:00:31) is 01 seconds

Plz Help

Tags (1)
0 Karma

splunkpoornima
Communicator

I used the search command as
source="task"|transaction task_action startswith=START endswith=Succeeded|Table_time task_action duration

90% of the result is coming correct ..
but for some case the result is not an exact difference

0 Karma

Ayn
Legend

Have a look at the duration field which is created by the transaction command, it should be precisely what you need.

supersleepwalke
Communicator

You might check that your time extractions are correct. If Splunk's interpretation of each event's time is incorrect, that could lead to the duration field being incorrect.

0 Karma

Ayn
Legend

Well, you need to check what is causing this problem - the functionality is there, so...

0 Karma

splunkpoornima
Communicator

I used the duration also but since i got wrong results for some cases

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...