topic Finding where multiple events have the same time in Getting Data In

Finding where multiple events have the same time

mikelanghorst — Thu, 26 Apr 2012 19:11:05 GMT

We had an issue here with one of our web fronted applications when the webserver received multiple requests to the same url down to the same millisecond. This caused the wrong file to be delivered to the first requestor. Obviously this was an issue with the code to allow the problem, but I couldn't think of how to find occurrences of this.

So for a given source, how to show where 2 or more events occur at the same time?

Re: Finding where multiple events have the same time

RicoSuave — Thu, 26 Apr 2012 19:34:27 GMT

<yoursearch> | transaction _time | where eventcount > 1

Re: Finding where multiple events have the same time

mikelanghorst — Thu, 26 Apr 2012 21:59:49 GMT

Thanks, hadn't thought of using transaction. A bit more filtering and this will work great. Just that one step took the results from 5k, down to 342 results.

Re: Finding where multiple events have the same time

ziegfried — Fri, 27 Apr 2012 10:46:16 GMT

Just an alternative that might be a bit more efficient:

... | eventstats count by _time | where count>0