https://community.splunk.com/t5/Knowledge-Management/Latency-between-transactions/m-p/106534#M7397 <P>I have logs which show a transaction with clear startswith and endswith tabling the duration taken like so</P> <P><CODE>source=*.csv | transaction E2ETxnSeq startswith="StartInbound" endswith="EndInbound" | table duration</CODE></P> <P>I'm looking for finding the latency between transactions (or actually the idle time between traansactions) so how do I pipe the above output to calculate the delta ?</P> <P>Thanks</P> Tue, 24 Jul 2012 08:55:23 GMT josekuzh 2012-07-24T08:55:23Z https://community.splunk.com/t5/Knowledge-Management/Latency-between-transactions/m-p/106534#M7397 <P>I have logs which show a transaction with clear startswith and endswith tabling the duration taken like so</P> <P><CODE>source=*.csv | transaction E2ETxnSeq startswith="StartInbound" endswith="EndInbound" | table duration</CODE></P> <P>I'm looking for finding the latency between transactions (or actually the idle time between traansactions) so how do I pipe the above output to calculate the delta ?</P> <P>Thanks</P> Tue, 24 Jul 2012 08:55:23 GMT https://community.splunk.com/t5/Knowledge-Management/Latency-between-transactions/m-p/106534#M7397 josekuzh 2012-07-24T08:55:23Z https://community.splunk.com/t5/Knowledge-Management/Latency-between-transactions/m-p/106535#M7398 <P>Can transactions overlap?</P> Tue, 24 Jul 2012 15:18:02 GMT https://community.splunk.com/t5/Knowledge-Management/Latency-between-transactions/m-p/106535#M7398 lguinn2 2012-07-24T15:18:02Z https://community.splunk.com/t5/Knowledge-Management/Latency-between-transactions/m-p/106536#M7399 <P>If transactions do <EM>not</EM> overlap, I imagine you could use <CODE>delta</CODE> for this.</P> <PRE><CODE>source=*.csv | transaction E2ETxnSeq startswith="StartInbound" endswith="EndInbound" | delta _time AS transactionlatency | eval transactionlatency=-transactionlatency | table duration transactionlatency </CODE></PRE> Tue, 24 Jul 2012 16:00:04 GMT https://community.splunk.com/t5/Knowledge-Management/Latency-between-transactions/m-p/106536#M7399 Ayn 2012-07-24T16:00:04Z https://community.splunk.com/t5/Knowledge-Management/Latency-between-transactions/m-p/106537#M7400 <P>actually they occasionally can but i can ignore those cases</P> Wed, 25 Jul 2012 05:15:00 GMT https://community.splunk.com/t5/Knowledge-Management/Latency-between-transactions/m-p/106537#M7400 josekuzh 2012-07-25T05:15:00Z https://community.splunk.com/t5/Knowledge-Management/Latency-between-transactions/m-p/106538#M7401 <P>I've tried this and transactionlatency is always 0 which doesnt match our data set. Still checking</P> Thu, 26 Jul 2012 05:17:25 GMT https://community.splunk.com/t5/Knowledge-Management/Latency-between-transactions/m-p/106538#M7401 josekuzh 2012-07-26T05:17:25Z