https://community.splunk.com/t5/Splunk-Dev/Find-number-of-results-based-on-transaction-start-and-end/m-p/408155#M7056 <P>Hi @aohls, </P> <P>I'm trying to understand what you are trying to solve. Unfortunately without any sample data I might not be able to.</P> <P>It would be good if you could provide us with some sample events you want to use your 'transaction' command on. </P> <P>Thanks!</P> Fri, 30 Nov 2018 19:59:10 GMT horsefez 2018-11-30T19:59:10Z https://community.splunk.com/t5/Splunk-Dev/Find-number-of-results-based-on-transaction-start-and-end/m-p/408154#M7055 <P>I am trying to find a way to get the count of number of concurrent reports running at one time. I can get a timechart with the count but it is using the time of the first result; so if the transaction has two events of 2:30 AM and 2:50 AM it will show 2:30 as the transaction time. I would like the event to show up throughout the entire time between the start and end time.</P> <P>Here is an example of the transaction I end up with and data I am pulling from. Not too complex for what the log has...</P> <P>INFO | 2018/11/30 14:30:00 | [INFO] START QuarterlyReport<BR /> INFO | 2018/11/30 14:55:00 | [INFO] FINISHED QuarterlyReport</P> <P>Currently I am only doing:<BR /> ....|transaction Start, End<BR /> |timechart count</P> <P>With this my timechart only counts 1 at 2:30, then 2:35 it will show zero. I was looking to have it so that my timechart line will remain at a count of 1 from 2:30 to 2:55, the duration of the report. In the end we can have multiple reports running at the same time so I wanted to get a count of total reports running during the span I set in the timechart.</P> Fri, 30 Nov 2018 18:31:46 GMT https://community.splunk.com/t5/Splunk-Dev/Find-number-of-results-based-on-transaction-start-and-end/m-p/408154#M7055 aohls 2018-11-30T18:31:46Z https://community.splunk.com/t5/Splunk-Dev/Find-number-of-results-based-on-transaction-start-and-end/m-p/408155#M7056 <P>Hi @aohls, </P> <P>I'm trying to understand what you are trying to solve. Unfortunately without any sample data I might not be able to.</P> <P>It would be good if you could provide us with some sample events you want to use your 'transaction' command on. </P> <P>Thanks!</P> Fri, 30 Nov 2018 19:59:10 GMT https://community.splunk.com/t5/Splunk-Dev/Find-number-of-results-based-on-transaction-start-and-end/m-p/408155#M7056 horsefez 2018-11-30T19:59:10Z https://community.splunk.com/t5/Splunk-Dev/Find-number-of-results-based-on-transaction-start-and-end/m-p/408156#M7057 <P>I updated with example events, there is not too much to the actual event. I want to count concurrent reports running at a specific time if that makes more sense.</P> Fri, 30 Nov 2018 20:26:17 GMT https://community.splunk.com/t5/Splunk-Dev/Find-number-of-results-based-on-transaction-start-and-end/m-p/408156#M7057 aohls 2018-11-30T20:26:17Z https://community.splunk.com/t5/Splunk-Dev/Find-number-of-results-based-on-transaction-start-and-end/m-p/408157#M7058 <P>Try this instead:</P> <PRE><CODE>index=YouShouldAlwaysSpecifyAnIndex sourcetype=AndSourcetypeToo "[INFO] FINISHED" | timechart count </CODE></PRE> Fri, 30 Nov 2018 22:37:03 GMT https://community.splunk.com/t5/Splunk-Dev/Find-number-of-results-based-on-transaction-start-and-end/m-p/408157#M7058 woodcock 2018-11-30T22:37:03Z