Hi guys,
I need help cause I want start a timer when i have one values and end this same timer when this values is different.
I would use the function Transaction but i think it's not the better solution.
Exemple: When the weither have the value 2 i start the timer and when the weither take after the values 1 i stop the timer.
index="xxx"
|fields logs{}.projectId,logs{}.newWeatherId
|transaction logs{}.projectId startswith=eval(logs{}.newWeatherId="2") endswith=eval(logs{}.newWeatherId!=2) keepevicted
Thanks for your answers.
you could try using the maxspan
and maxpause
options in transaction but i'm not sure that's really what you're going for.
If you're using v6.5, try using streamstats.
http://docs.splunk.com/Documentation/Splunk/6.5.3/SearchReference/Streamstats
The reset_on_change command might be what you need.
transaction creates a default field called duration which captures what you are intending. Just pipe
| table logs{}.projectID eventcount duration
However, better way would be to go for stats command to handle such scenarios which will perform better.