https://community.splunk.com/t5/Splunk-Search/transaction-startswith-1-endswith-multiple/m-p/182687#M186919 <P>Hi all, simple question I hope.<BR /> I have a system that has one starting event with multiple outputs and I want to find out how long it takes for the system to produce each output. When I use a transaction, it only seems to give me the combination of the input and just <STRONG>one</STRONG> of the outputs, where I actually need all of the outputs. </P> <PRE><CODE>transaction activity_id startswith=input_event_name, endswith=output_event_name </CODE></PRE> <P>Any ideas how I can include all the the outputs? Or is there a much better way to do this?</P> <P>Many thanks</P> Thu, 29 May 2014 17:00:13 GMT leea11 2014-05-29T17:00:13Z https://community.splunk.com/t5/Splunk-Search/transaction-startswith-1-endswith-multiple/m-p/182687#M186919 <P>Hi all, simple question I hope.<BR /> I have a system that has one starting event with multiple outputs and I want to find out how long it takes for the system to produce each output. When I use a transaction, it only seems to give me the combination of the input and just <STRONG>one</STRONG> of the outputs, where I actually need all of the outputs. </P> <PRE><CODE>transaction activity_id startswith=input_event_name, endswith=output_event_name </CODE></PRE> <P>Any ideas how I can include all the the outputs? Or is there a much better way to do this?</P> <P>Many thanks</P> Thu, 29 May 2014 17:00:13 GMT https://community.splunk.com/t5/Splunk-Search/transaction-startswith-1-endswith-multiple/m-p/182687#M186919 leea11 2014-05-29T17:00:13Z https://community.splunk.com/t5/Splunk-Search/transaction-startswith-1-endswith-multiple/m-p/182688#M186920 <P>I don't know how to handle that situation in a transaction, but perhaps this will help.</P> <PRE><CODE>input_event_name | join activity_id max=0 overwrite=false [ search output_event_name ] | ... </CODE></PRE> Thu, 29 May 2014 17:26:50 GMT https://community.splunk.com/t5/Splunk-Search/transaction-startswith-1-endswith-multiple/m-p/182688#M186920 richgalloway 2014-05-29T17:26:50Z https://community.splunk.com/t5/Splunk-Search/transaction-startswith-1-endswith-multiple/m-p/182689#M186921 <P>Can you provide some sample logs?</P> Thu, 29 May 2014 19:29:18 GMT https://community.splunk.com/t5/Splunk-Search/transaction-startswith-1-endswith-multiple/m-p/182689#M186921 somesoni2 2014-05-29T19:29:18Z https://community.splunk.com/t5/Splunk-Search/transaction-startswith-1-endswith-multiple/m-p/182690#M186922 <P>How about using <STRONG>stats</STRONG> instead of <STRONG>transaction</STRONG>? Perhaps something like this:</P> <PRE><CODE>... your search ... | eval StartTime=if(searchmatch("input_event_name"),_time,null()) | eval EndTime=if(searchmatch("output_event_name"),_time,null()) | stats values(StartTime) as StartTime values(EndTime) as EndTime by activity_id | mvexpand EndTime | eval TransactionTime=EndTime - StartTime </CODE></PRE> <P>This will give you the activity_id, start time, end time, and duration for every instance of output_event_name. If you need to see other information, just modify the <STRONG>stats</STRONG> statement to include it.</P> Mon, 28 Sep 2020 16:45:46 GMT https://community.splunk.com/t5/Splunk-Search/transaction-startswith-1-endswith-multiple/m-p/182690#M186922 wpreston 2020-09-28T16:45:46Z https://community.splunk.com/t5/Splunk-Search/transaction-startswith-1-endswith-multiple/m-p/182691#M186923 <P>A thousand thank yous wpreston, that worked a treat!</P> Fri, 30 May 2014 09:16:36 GMT https://community.splunk.com/t5/Splunk-Search/transaction-startswith-1-endswith-multiple/m-p/182691#M186923 leea11 2014-05-30T09:16:36Z https://community.splunk.com/t5/Splunk-Search/transaction-startswith-1-endswith-multiple/m-p/182692#M186924 <P>You're very welcome, happy to help!</P> Fri, 30 May 2014 12:59:00 GMT https://community.splunk.com/t5/Splunk-Search/transaction-startswith-1-endswith-multiple/m-p/182692#M186924 wpreston 2014-05-30T12:59:00Z