topic Re: Transaction Maxpause doesn't work in Splunk Search https://community.splunk.com/t5/Splunk-Search/Transaction-Maxpause-doesn-t-work/m-p/365603#M107811 <P>Do not use <CODE>transaction</CODE>; we can use <CODE>streamstats</CODE> to implement your <CODE>maxpause</CODE> requirement to manufacture <CODE>sessionIDs</CODE>.</P> <P>This fakes your data:</P> <PRE><CODE>| makeresults | eval raw="2017-03-17 00:25:48 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:25:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:25:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:25:21 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:25:21 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:25:11 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:25:11 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:25:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:27 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:27 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:48 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:48 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:48 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:45 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:45 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:22 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:22 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:22 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:48 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:48 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:22 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:55 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:55 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:22 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:22 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:19:48 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:59:22 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:59:09 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:59:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:58:57 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:58:55 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:58:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:49:12 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:49:09 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:49:09 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:49:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10" | rex field=raw mode=sed "s/[\r\n]+\s*/::/g" | makemv delim="::" raw | mvexpand raw | rex field=raw "\s*(?&lt;time&gt;\d+-\d+-\d+\s+\d+:\d+:\d+)\s+(?&lt;duration_measure&gt;\S+)\s+(?&lt;code&gt;\S+)\s+(?&lt;loglevel&gt;\S+)\s+(?&lt;durationLimitInMinutes&gt;\S+)$" | eval _time = strptime(time, "%Y-%m-%d %H:%M:%S") | fields - raw time </CODE></PRE> <P>This is your solution:</P> <PRE><CODE>| eval durationLimitInSeconds=durationLimitInMinutes*60 | where _time&gt;relative_time(now(), "-2h-120") | streamstats current=f last(_time) AS next_time BY code | eval pause = next_time - _time | fillnull value="0" pause | streamstats count(eval(pause&gt;10)) AS sessionID BY code | fields - next_time pause | stats min(_time) AS _time values(*) AS * range(_time) AS duration count AS eventcount BY code sessionID </CODE></PRE> <P>At this time, to see it work requires the removal of this line: <CODE>| where _time&gt;relative_time(now(), "-2h-120")</CODE>.</P> Fri, 17 Mar 2017 17:36:52 GMT woodcock 2017-03-17T17:36:52Z Transaction Maxpause doesn't work https://community.splunk.com/t5/Splunk-Search/Transaction-Maxpause-doesn-t-work/m-p/365602#M107810 <P>I am trying to get the transaction results from a lookup file and I have _time field written into it for this to work. The duration condition seems to be working, but the query stops working the moment I add maxpause condition to it. Below is the query I am currently trying to fix.<BR /> Please help me here.</P> <PRE><CODE>| inputlookup LOOKUP.csv | eval durationLimitInSeconds=durationLimitInMinutes*60 | eval now=now() | eval temp=(now-(2*60*60)-120) | where _time&gt;temp | transaction maxpause=10s code | where eventcount&gt;2 AND duration&gt;durationLimitInSeconds | fields _time code duration durationLimitInSeconds eventcount </CODE></PRE> <P>Below is the sample data, if it helps. I want events with pause more than a few seconds (10s) to be considered as a different transaction, but the query I use treats all of them as single event and if I include maxpause, the query doesn't work at all.</P> <PRE><CODE>_time duration_measure code loglevel durationLimitInMinutes 2017-03-17 00:25:48 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:25:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:25:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:25:21 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:25:21 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:25:11 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:25:11 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:25:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:27 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:27 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:48 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:48 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:48 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:45 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:45 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:22 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:22 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:22 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:48 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:48 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:22 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:55 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:55 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:22 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:22 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:19:48 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:59:22 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:59:09 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:59:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:58:57 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:58:55 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:58:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:49:12 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:49:09 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:49:09 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:49:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 </CODE></PRE> Fri, 17 Mar 2017 05:54:01 GMT https://community.splunk.com/t5/Splunk-Search/Transaction-Maxpause-doesn-t-work/m-p/365602#M107810 edookati 2017-03-17T05:54:01Z Re: Transaction Maxpause doesn't work https://community.splunk.com/t5/Splunk-Search/Transaction-Maxpause-doesn-t-work/m-p/365603#M107811 <P>Do not use <CODE>transaction</CODE>; we can use <CODE>streamstats</CODE> to implement your <CODE>maxpause</CODE> requirement to manufacture <CODE>sessionIDs</CODE>.</P> <P>This fakes your data:</P> <PRE><CODE>| makeresults | eval raw="2017-03-17 00:25:48 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:25:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:25:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:25:21 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:25:21 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:25:11 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:25:11 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:25:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:27 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:27 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:24:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:48 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:48 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:48 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:45 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:45 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:22 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:23:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:22 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:22 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:22:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:48 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:48 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:22 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:21:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:55 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:55 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:46 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:22 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:22 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:20:00 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-17 00:19:48 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:59:22 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:59:09 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:59:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:58:57 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:58:55 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:58:41 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:49:12 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:49:09 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:49:09 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10 2017-03-16 23:49:06 m EVENTAPI_FAILED_PROPORTION_ERROR ERROR 10" | rex field=raw mode=sed "s/[\r\n]+\s*/::/g" | makemv delim="::" raw | mvexpand raw | rex field=raw "\s*(?&lt;time&gt;\d+-\d+-\d+\s+\d+:\d+:\d+)\s+(?&lt;duration_measure&gt;\S+)\s+(?&lt;code&gt;\S+)\s+(?&lt;loglevel&gt;\S+)\s+(?&lt;durationLimitInMinutes&gt;\S+)$" | eval _time = strptime(time, "%Y-%m-%d %H:%M:%S") | fields - raw time </CODE></PRE> <P>This is your solution:</P> <PRE><CODE>| eval durationLimitInSeconds=durationLimitInMinutes*60 | where _time&gt;relative_time(now(), "-2h-120") | streamstats current=f last(_time) AS next_time BY code | eval pause = next_time - _time | fillnull value="0" pause | streamstats count(eval(pause&gt;10)) AS sessionID BY code | fields - next_time pause | stats min(_time) AS _time values(*) AS * range(_time) AS duration count AS eventcount BY code sessionID </CODE></PRE> <P>At this time, to see it work requires the removal of this line: <CODE>| where _time&gt;relative_time(now(), "-2h-120")</CODE>.</P> Fri, 17 Mar 2017 17:36:52 GMT https://community.splunk.com/t5/Splunk-Search/Transaction-Maxpause-doesn-t-work/m-p/365603#M107811 woodcock 2017-03-17T17:36:52Z Re: Transaction Maxpause doesn't work https://community.splunk.com/t5/Splunk-Search/Transaction-Maxpause-doesn-t-work/m-p/365604#M107812 <P>Thanks. It works. Can you please explain what eval(pause&gt;10) does here? Does it count the instances of all pauses which are greater than 10 seconds. Also, how do I store the session ID and not repeat it, at least for a couple of days. Sorry, I am not familiar with streamstats.<BR /> Thanks a lot.</P> Wed, 22 Mar 2017 02:56:35 GMT https://community.splunk.com/t5/Splunk-Search/Transaction-Maxpause-doesn-t-work/m-p/365604#M107812 edookati 2017-03-22T02:56:35Z Re: Transaction Maxpause doesn't work https://community.splunk.com/t5/Splunk-Search/Transaction-Maxpause-doesn-t-work/m-p/365605#M107813 <P>It keeps a running total when scanning from the newest event backwards towards the last event. If the event being examined has a pause&lt;=10 then the count is not incremented so that event is included with the previous events by sessionID. There is no way to store it that makes any sense at all (more work than just recalculating it).</P> Wed, 22 Mar 2017 15:20:32 GMT https://community.splunk.com/t5/Splunk-Search/Transaction-Maxpause-doesn-t-work/m-p/365605#M107813 woodcock 2017-03-22T15:20:32Z Re: Transaction Maxpause doesn't work https://community.splunk.com/t5/Splunk-Search/Transaction-Maxpause-doesn-t-work/m-p/365606#M107814 <P>Thanks a lot.</P> Thu, 23 Mar 2017 07:43:19 GMT https://community.splunk.com/t5/Splunk-Search/Transaction-Maxpause-doesn-t-work/m-p/365606#M107814 edookati 2017-03-23T07:43:19Z