https://community.splunk.com/t5/Splunk-Search/How-to-build-a-list-of-simultaneously-running-threads/m-p/249813#M189272 <P>that is the magic! thanks! and not so hard after all. should be put in the toolbox for severe cases like that. accepted with gratitude. thank you!</P> Tue, 30 Aug 2016 10:03:44 GMT fiodar_ram 2016-08-30T10:03:44Z https://community.splunk.com/t5/Splunk-Search/How-to-build-a-list-of-simultaneously-running-threads/m-p/249801#M189260 <P>Given the log events, containing time, name of thread and whether the thread has started or stopped :<BR /> _time , thread_name, start/end</P> <P>How to build a list of thread names that a currently running?</P> Tue, 29 Sep 2020 10:45:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-build-a-list-of-simultaneously-running-threads/m-p/249801#M189260 fiodar_ram 2020-09-29T10:45:02Z https://community.splunk.com/t5/Splunk-Search/How-to-build-a-list-of-simultaneously-running-threads/m-p/249802#M189261 <P>Have you looked at this</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Concurrency">https://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Concurrency</A></P> Thu, 25 Aug 2016 16:18:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-build-a-list-of-simultaneously-running-threads/m-p/249802#M189261 sundareshr 2016-08-25T16:18:43Z https://community.splunk.com/t5/Splunk-Search/How-to-build-a-list-of-simultaneously-running-threads/m-p/249803#M189262 <P>Thank you!</P> <P>It was exactly what i was looking for! It worked like a charm and i could calculate the count.</P> <P>But, out of curiosity and naughtiness: how to not just count using concurrency command, but how to build a list?</P> Fri, 26 Aug 2016 12:27:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-build-a-list-of-simultaneously-running-threads/m-p/249803#M189262 fiodar_ram 2016-08-26T12:27:31Z https://community.splunk.com/t5/Splunk-Search/How-to-build-a-list-of-simultaneously-running-threads/m-p/249804#M189263 <P>You could try something like</P> <PRE><CODE>... | stats values(thread_name) as threads by start </CODE></PRE> Fri, 26 Aug 2016 13:06:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-build-a-list-of-simultaneously-running-threads/m-p/249804#M189263 sundareshr 2016-08-26T13:06:46Z https://community.splunk.com/t5/Splunk-Search/How-to-build-a-list-of-simultaneously-running-threads/m-p/249805#M189264 <P>thank you, but what if i want to know how the list changes over time? </P> Fri, 26 Aug 2016 16:00:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-build-a-list-of-simultaneously-running-threads/m-p/249805#M189264 fiodar_ram 2016-08-26T16:00:27Z https://community.splunk.com/t5/Splunk-Search/How-to-build-a-list-of-simultaneously-running-threads/m-p/249806#M189265 <P>Try this</P> <PRE><CODE>... | bin span=1h start | stats values(thread_name) as threads count(thread_name) as count by start </CODE></PRE> Fri, 26 Aug 2016 16:05:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-build-a-list-of-simultaneously-running-threads/m-p/249806#M189265 sundareshr 2016-08-26T16:05:37Z https://community.splunk.com/t5/Splunk-Search/How-to-build-a-list-of-simultaneously-running-threads/m-p/249807#M189266 <P>Just putting this in as an answer - <A href="https://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Concurrency">https://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Concurrency</A></P> Fri, 26 Aug 2016 20:11:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-build-a-list-of-simultaneously-running-threads/m-p/249807#M189266 jdonn_splunk 2016-08-26T20:11:56Z https://community.splunk.com/t5/Splunk-Search/How-to-build-a-list-of-simultaneously-running-threads/m-p/249808#M189267 <P>this would give the names and a count of threads, which have started (or have any event) in each hour. but what if a thread has started before an hour and did not stop and did not emit any events in the log. it would not be counted. </P> Mon, 29 Aug 2016 14:57:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-build-a-list-of-simultaneously-running-threads/m-p/249808#M189267 fiodar_ram 2016-08-29T14:57:29Z https://community.splunk.com/t5/Splunk-Search/How-to-build-a-list-of-simultaneously-running-threads/m-p/249809#M189268 <P>but how to build a list of thread names and how the list changes over time?<BR /> example:<BR /> time | thread names<BR /> 1h | a,b<BR /> 2h | a,b,c<BR /> 3H | a<BR /> ...</P> Mon, 29 Aug 2016 14:59:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-build-a-list-of-simultaneously-running-threads/m-p/249809#M189268 fiodar_ram 2016-08-29T14:59:50Z https://community.splunk.com/t5/Splunk-Search/How-to-build-a-list-of-simultaneously-running-threads/m-p/249810#M189269 <P>You best bet is to use the <CODE>concurrency</CODE> command to get accurate results. Having said that, this will give you everything that started within the hour. This will not give you events that overlap hours. So if it starts at 11:00 and ends at 12:15, will be counted in the 11:00 hr. count</P> Mon, 29 Aug 2016 15:20:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-build-a-list-of-simultaneously-running-threads/m-p/249810#M189269 sundareshr 2016-08-29T15:20:25Z https://community.splunk.com/t5/Splunk-Search/How-to-build-a-list-of-simultaneously-running-threads/m-p/249811#M189270 <P>how to list a thread name in the 12:00 hr, if it starts at 11:00 and ends at 13:15? that is the question.</P> Mon, 29 Aug 2016 15:26:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-build-a-list-of-simultaneously-running-threads/m-p/249811#M189270 fiodar_ram 2016-08-29T15:26:02Z https://community.splunk.com/t5/Splunk-Search/How-to-build-a-list-of-simultaneously-running-threads/m-p/249812#M189271 <P>Try something like this (you'll have to tweak it)</P> <P>... | eval range=mvrange(start, end, "1h") | mvexpand range | bin span=1h range | stats values(thread_name) as threads count(thread_name) as count by range</P> Tue, 29 Sep 2020 10:50:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-build-a-list-of-simultaneously-running-threads/m-p/249812#M189271 sundareshr 2020-09-29T10:50:44Z https://community.splunk.com/t5/Splunk-Search/How-to-build-a-list-of-simultaneously-running-threads/m-p/249813#M189272 <P>that is the magic! thanks! and not so hard after all. should be put in the toolbox for severe cases like that. accepted with gratitude. thank you!</P> Tue, 30 Aug 2016 10:03:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-build-a-list-of-simultaneously-running-threads/m-p/249813#M189272 fiodar_ram 2016-08-30T10:03:44Z https://community.splunk.com/t5/Splunk-Search/How-to-build-a-list-of-simultaneously-running-threads/m-p/249814#M189273 <P>so to sum up:<BR /> 1. | concurrency - for counts<BR /> 2. | eval range=mvrange(start, end, "1h") | mvexpand range | bin span=1h range | stats values(thread_name) as threads count(thread_name) as count by range - for lists, to build missing event entries in time</P> Tue, 29 Sep 2020 10:51:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-build-a-list-of-simultaneously-running-threads/m-p/249814#M189273 fiodar_ram 2020-09-29T10:51:08Z