https://community.splunk.com/t5/Splunk-Search/How-to-get-concurrent-transactions-for-multiple-hosts/m-p/185914#M187007 <P>Hello,</P> <P>I'm having trouble getting concurrent events by host.</P> <P>I can get concurrent key transactions for a single host, and it appears accurate:<BR /> * sourcetype="*iis" Target_Type="key" host="na5" | concurrency duration=TimeTaken | timechart span=1h count(concurrency)</P> <P>But when I try to get this for all hosts (Grouped by host), it’s comparing the data on all instances, artificially inflating number of concurrent transactions per host:<BR /> * sourcetype="*iis" Target_Type="key" | concurrency duration=TimeTaken | timechart span=1h count(concurrency) by host</P> <P>Any ideas?</P> Mon, 18 Aug 2014 22:04:17 GMT drmed 2014-08-18T22:04:17Z https://community.splunk.com/t5/Splunk-Search/How-to-get-concurrent-transactions-for-multiple-hosts/m-p/185914#M187007 <P>Hello,</P> <P>I'm having trouble getting concurrent events by host.</P> <P>I can get concurrent key transactions for a single host, and it appears accurate:<BR /> * sourcetype="*iis" Target_Type="key" host="na5" | concurrency duration=TimeTaken | timechart span=1h count(concurrency)</P> <P>But when I try to get this for all hosts (Grouped by host), it’s comparing the data on all instances, artificially inflating number of concurrent transactions per host:<BR /> * sourcetype="*iis" Target_Type="key" | concurrency duration=TimeTaken | timechart span=1h count(concurrency) by host</P> <P>Any ideas?</P> Mon, 18 Aug 2014 22:04:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-concurrent-transactions-for-multiple-hosts/m-p/185914#M187007 drmed 2014-08-18T22:04:17Z https://community.splunk.com/t5/Splunk-Search/How-to-get-concurrent-transactions-for-multiple-hosts/m-p/185915#M187008 <P>Concurrency doesn't have by clause. You may have to try something like this<BR /> <A href="http://">http://answers.splunk.com/answers/7269/how-to-calculate-concurrent-transactions-grouped-with-a-particular-field</A></P> Mon, 18 Aug 2014 22:24:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-concurrent-transactions-for-multiple-hosts/m-p/185915#M187008 strive 2014-08-18T22:24:33Z https://community.splunk.com/t5/Splunk-Search/How-to-get-concurrent-transactions-for-multiple-hosts/m-p/185916#M187009 <P>Thanks. Hope we can get concurrency by clause soon. This seems like a very common use case. For now, we are going to use a dashboard with host selection in a dropdown.</P> <P>I tried to get the query in strive's link above working. Unfortunately it doesn't work for our data. A lot of assumptions go into how your Splunk data is setup (start / stop / other transactions) to make this work:<BR /> sourcetype="*traceappender" | eval counter = if(searchmatch("Module.Begin"),1,-1) | sort 0 + _time | streamstats sum(counter) as concurrency by host | timechart span=1h count(concurrency) by host</P> Mon, 18 Aug 2014 23:17:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-concurrent-transactions-for-multiple-hosts/m-p/185916#M187009 drmed 2014-08-18T23:17:21Z https://community.splunk.com/t5/Splunk-Search/How-to-get-concurrent-transactions-for-multiple-hosts/m-p/185917#M187010 <P>This post has the best reply IMO<BR /> <A href="http://answers.splunk.com/answers/153299/bulletproof-approach-for-charting-concurrency-with-split-by-field.html">http://answers.splunk.com/answers/153299/bulletproof-approach-for-charting-concurrency-with-split-by-field.html</A></P> Fri, 10 Oct 2014 11:23:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-concurrent-transactions-for-multiple-hosts/m-p/185917#M187010 manus 2014-10-10T11:23:11Z https://community.splunk.com/t5/Splunk-Search/How-to-get-concurrent-transactions-for-multiple-hosts/m-p/185918#M187011 <P>I agree ... I repeatedly have had to use a cludge to get <EM>concurrency ... by ...</EM></P> Thu, 06 Apr 2017 10:22:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-concurrent-transactions-for-multiple-hosts/m-p/185918#M187011 JeToJedno 2017-04-06T10:22:54Z