topic Re: Transaction shows incomplete statistics in Splunk Search

Transaction shows incomplete statistics

sunnyb147 — Tue, 25 Jun 2019 12:21:45 GMT

Hi All,
I am trying to group the events using transaction command but looks like some of the data is not visible in the statistics.

Are there any limit kind of a thing which we can set?
If I run below search for lets say a day or two it works fine, but if I run this search for 7 days it shows the result just for 5 days.

Sample search:

(index=test1 logpoint="request-in") OR (index=test1 logpoint="response-in")
| transaction transaction-id startswith="request-in" endswith="response-in" maxevents=2 keeporphans=true 
| eval epoch_time=strptime('timestamp-in',"%Y-%m-%dT%H:%M:%S.%N")
| eventstats range(epoch_time) as response_time by transaction-id
| timechart span=1d avg(response_time) as average_duration

Any help would be highly appreciated.

Thanks,
Sunny

Re: Transaction shows incomplete statistics

amitm05 — Wed, 26 Jun 2019 10:03:26 GMT

Ques -
Have you made sure you have relevant data events available on the dates of 18, 19, 20 ?
Is this the same behavior if you run your search over a different set of 7 days ?

Re: Transaction shows incomplete statistics

sunnyb147 — Thu, 27 Jun 2019 07:49:49 GMT

I think I found the solution, instead of eventstats I used stats and it worked 🙂

Another small question: I cannot mark this question as closed.. could you please guide me on this.

Re: Transaction shows incomplete statistics

DavidHourani — Thu, 27 Jun 2019 08:12:40 GMT

to close the question, simply answer it if you have the answer and accept your answer 🙂

Re: Transaction shows incomplete statistics

DavidHourani — Thu, 27 Jun 2019 08:18:14 GMT

Hi @sunnyb147,

Using transactions is resource intensive you can replace it with this which runs only on stats as it will run way faster:

 index=test1 logpoint="request-in" OR logpoint="response-in"
 | stats first(_time) as start last(_time) as end first(timestamp-in) as timestamp-in by transaction-id 
 | eval _time=strptime('timestamp-in',"%Y-%m-%dT%H:%M:%S.%N")
 | eval duration=tostring(end-start,"duration")
 | timechart span=1d avg(duration) as average_duration

Cheers,
David

Re: Transaction shows incomplete statistics

sunnyb147 — Thu, 27 Jun 2019 09:30:19 GMT

Thanks David for the feedback 🙂 Today morning I realized the same thing and it worked like a charm.

Re: Transaction shows incomplete statistics

DavidHourani — Thu, 27 Jun 2019 09:32:58 GMT

awesome ! good work 😉

Re: Transaction shows incomplete statistics

sunnyb147 — Thu, 27 Jun 2019 09:33:32 GMT

Thank you 🙂 Done !