Splunk Search

calculate time statistics over an hour, but only find releated events that occur within one minute

systemsatpayzon
Path Finder

I am trying to calculate statistics for when a transaction enters our application, and when the reply is sent from the application. I would like to calculate statistics over an hour and there are two key values that i use to find the events to caculate on (research and Locsite). Here is the query:

      sourcetype="Filter" transactionType=A44 | stats min(_time) AS earliest max(_time) AS latest by research,Locsite | eval duration=latest-earliest

this query returns the duration of the transaction. this query is good enough most of the time but sometimes events with the same "research" and "Locsite" is returned more than two times within the time range of an hour, then the duration value will be calculated over too long time. So i would like my query to only look for events with the same "Locsite" and "research" within one minute, but calculate statistics over the whole timerange

Tags (3)
0 Karma

systemsatpayzon
Path Finder

I solved it myself!

sourcetype="Filter" a44 | transaction research maxevents=2 |stats min(duration) max(duration) avg(duration) median(duration) perc95(duration)
0 Karma

aholzer
Motivator

Sound like a good use case for the "transaction" command. Here's some documentation to get you started:
http://docs.splunk.com/Documentation/Splunk/5.0.3/Knowledge/Searchfortransactions
http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Transaction

Make sure to take careful note of maxspan and maxpause options.

Hope this helps!

systemsatpayzon
Path Finder

A better alternative would be to find consecutive occurences of the same value for the keys "research" and "Locsite" (request and response)

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...