https://community.splunk.com/t5/Monitoring-Splunk/decompose-response-time/m-p/85778#M1058 <P>The transaction command may be the right approach in this case. Take a look at this previous answer which is very detailed.</P> <P><A href="http://splunk-base.splunk.com/answers/29172/transaction-problems-with-lots-of-events-and-multiple-fields">http://splunk-base.splunk.com/answers/29172/transaction-problems-with-lots-of-events-and-multiple-fields</A></P> <P>From the docs (there are example transactions): <BR /> <A href="http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Transaction">http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Transaction</A></P> <P>The Transaction profiling app might be interesting for you to look at as well.</P> <P><A href="http://splunk-base.splunk.com/apps/29011/splunk-app-for-transaction-profiling-preview">http://splunk-base.splunk.com/apps/29011/splunk-app-for-transaction-profiling-preview</A></P> Wed, 10 Oct 2012 12:27:40 GMT sdaniels 2012-10-10T12:27:40Z https://community.splunk.com/t5/Monitoring-Splunk/decompose-response-time/m-p/85777#M1057 <P>I am tracking reponse time in n-tiers applications. </P> <P>Let's assume that we have a client request log and a database request log. Each client request has a unique transaction_ID in the client log. The database log records 3 different requests for a single client request and specifies the transaction_ID corresponding to the client request served by the database requests.</P> <P>I would like to correlate the client and database log so that I can decompose the client request time in "application time" and "database time" (sum of the 3 database request response time).</P> <P>Also, I would like to drill down on the database time to see the 3 different requests.</P> <P>What do you recommend ?</P> Mon, 28 Sep 2020 12:36:16 GMT https://community.splunk.com/t5/Monitoring-Splunk/decompose-response-time/m-p/85777#M1057 fcarre 2020-09-28T12:36:16Z https://community.splunk.com/t5/Monitoring-Splunk/decompose-response-time/m-p/85778#M1058 <P>The transaction command may be the right approach in this case. Take a look at this previous answer which is very detailed.</P> <P><A href="http://splunk-base.splunk.com/answers/29172/transaction-problems-with-lots-of-events-and-multiple-fields">http://splunk-base.splunk.com/answers/29172/transaction-problems-with-lots-of-events-and-multiple-fields</A></P> <P>From the docs (there are example transactions): <BR /> <A href="http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Transaction">http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Transaction</A></P> <P>The Transaction profiling app might be interesting for you to look at as well.</P> <P><A href="http://splunk-base.splunk.com/apps/29011/splunk-app-for-transaction-profiling-preview">http://splunk-base.splunk.com/apps/29011/splunk-app-for-transaction-profiling-preview</A></P> Wed, 10 Oct 2012 12:27:40 GMT https://community.splunk.com/t5/Monitoring-Splunk/decompose-response-time/m-p/85778#M1058 sdaniels 2012-10-10T12:27:40Z