Splunk Search

how to get number of concurrent sessions per minute

Laya123
Communicator

Hi ,

How to get number of concurrent sessions per minute. My transaction started with beginning session and ends with ending session

for example

my first transaction started at 12-3-2015 10:01:00, second transaction started at 12-3-2015 10:01:10, third transaction started at 12-3-2015 10:01:35, fourth transaction started at 12-3-2015 10:02:15, fifth transaction started at 12-3-2015 10:02:40

My second transaction ended at 12-3-2015 10:01:50

I want my output like

12-3-2015 10:01:00 - number of transactions 3
12-3-2015 10:02:00 - Number of transactions 4 (second transaction completed in last minute only thats why I excluded that in next minute)

Thanks in advance

Tags (2)
0 Karma
1 Solution

fdi01
Motivator

try like this:

...| transaction startswith="beginning session" endswith="ending session" |bucket span=1m _time|stats count as "number of transactions" by _time

or

 ...| transaction startswith="beginning session " endswith="ending session " | timechart per_minute(eval(count)) as "number of transactions"

View solution in original post

0 Karma

fdi01
Motivator

try like this:

...| transaction startswith="beginning session" endswith="ending session" |bucket span=1m _time|stats count as "number of transactions" by _time

or

 ...| transaction startswith="beginning session " endswith="ending session " | timechart per_minute(eval(count)) as "number of transactions"
0 Karma

stephane_cyrill
Builder

Hi here is something for you.

1.
source="" | transaction startswith="beginning session "
endswith="ending session " |timechart count span=1m as
"number of transactions"

However if this returns more than 50,000 results it
wont work and it'll return that bucketing error.

OR

2.
source="" | transaction startswith="beginning session "
endswith="ending session " |eval count=1
| timechart per_minute (count) as
"number of transactions"

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...