https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-the-average-durations-and-assemble-this-into-a/m-p/390705#M69879 <P>Hello,</P> <P>I've looked at a lot of the duration posts (covering transaction, streamstats, etc.) -- generally these deal with very particular events, so I'm having some trouble generalizing to look at all of our durations (to then chart out ranges of durations, etc).</P> <P>Some background:<BR /> All of our events have a userId (unique GUID), and then a sessionID (counts up from 1 for every new user).<BR /> The durations I am interested in are: given each userID/sessionID combo, there should be one instance (event) where eventName=Start, and one instance where eventName=End, so duration is the timestamp of the End event - timestamp of the Start event.</P> <P>There is no dateTime field within our event - just using the event Timestamp in Splunk associated with each event.</P> <P>I would appreciate any advice on assembling this into a table/report of duration data that would cover all UserId/SessionId combos</P> <P>Thanks!</P> Tue, 15 May 2018 00:35:19 GMT bhartmann 2018-05-15T00:35:19Z https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-the-average-durations-and-assemble-this-into-a/m-p/390705#M69879 <P>Hello,</P> <P>I've looked at a lot of the duration posts (covering transaction, streamstats, etc.) -- generally these deal with very particular events, so I'm having some trouble generalizing to look at all of our durations (to then chart out ranges of durations, etc).</P> <P>Some background:<BR /> All of our events have a userId (unique GUID), and then a sessionID (counts up from 1 for every new user).<BR /> The durations I am interested in are: given each userID/sessionID combo, there should be one instance (event) where eventName=Start, and one instance where eventName=End, so duration is the timestamp of the End event - timestamp of the Start event.</P> <P>There is no dateTime field within our event - just using the event Timestamp in Splunk associated with each event.</P> <P>I would appreciate any advice on assembling this into a table/report of duration data that would cover all UserId/SessionId combos</P> <P>Thanks!</P> Tue, 15 May 2018 00:35:19 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-the-average-durations-and-assemble-this-into-a/m-p/390705#M69879 bhartmann 2018-05-15T00:35:19Z https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-the-average-durations-and-assemble-this-into-a/m-p/390706#M69880 <P>Is it like this?</P> <PRE><CODE>(your search) | transaction userId sessionID startswith=start endswith=end | stats avg(duration) by userId sessionID </CODE></PRE> Tue, 15 May 2018 01:59:47 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-the-average-durations-and-assemble-this-into-a/m-p/390706#M69880 HiroshiSatoh 2018-05-15T01:59:47Z https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-the-average-durations-and-assemble-this-into-a/m-p/390707#M69881 <P>Yes, this gets me past the first big hurdle, thank you!</P> <P>Looks like from here I can play around with different visualization options. I'll do some further research into putting these results into "bins" (like "&lt;30 sec", "30-60 sec", etc.) to then build a histogram.</P> Tue, 15 May 2018 15:49:33 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-the-average-durations-and-assemble-this-into-a/m-p/390707#M69881 bhartmann 2018-05-15T15:49:33Z