topic Time difference within a transaction command in Splunk Search

Time difference within a transaction command

tbrown — Wed, 10 Jun 2020 20:13:38 GMT

I have a search that uses the transaction:

| transaction startswith=<...> endswith=<...>

Command to group it into certain events I want to see. How would I search this even further to get the time difference between each event in this transaction and then graph these time differences to a line/bar graph with the events/hosts on X-axis and time on y-axis. There are no specific fields for each event that I want to use to calculate the time difference, I only want to show the time difference between each and every raw log in this transaction.

Re: Time difference within a transaction command

richgalloway — Wed, 10 Jun 2020 13:28:55 GMT

The duration field shows the time difference between the first and last events in the transaction. To get the deltas between individual events you'll have to parse the transaction.

Re: Time difference within a transaction command

tbrown — Wed, 10 Jun 2020 18:08:36 GMT

@richgalloway

What would that command look like then? I have been trying to parse the transactions but haven't been able to find a working command that calculates the delta times.