Reporting on multiple transactions

bruceat — Thu, 06 Feb 2014 12:40:37 GMT

Hi all,

I want to track the duration of individual steps of a larger transaction. For example, I have :

2014-02-05 20:01:25 lcid=12345 Starting transaction 
2014-02-05 20:01:31 lcid=12345 Starting step A
2014-02-05 20:01:38 lcid=12345 Finished step A
2014-02-05 20:01:40 lcid=12345 Something else
2014-02-05 20:01:41 lcid=12345 Starting step B
2014-02-05 20:01:48 lcid=12345 Finished step B
2014-02-05 20:01:51 lcid=12345 Starting step C
2014-02-05 20:01:51 lcid=67890 Something else again
2014-02-05 20:01:58 lcid=12345 Finished step C
2014-02-05 20:02:00 lcid=12345 Finished transaction

What I would like to do is to extract "step A", "step B" and "step C" durations individually.

I can do this for a single step easily enough with:
transaction lcid startswith="Starting step A" endswith="Finished step A"

Is there a way to get the duration for each of the three steps?

Thanks

Re: Reporting on multiple transactions

somesoni2 — Thu, 06 Feb 2014 14:36:54 GMT

Try this.

..your main search..| rex "lcid=[\d]*\s(?<status>[^ ]*)\s(step |trans)(?<actor>[^ ]*)" | eval actor=if(actor="action","Main",actor) | transaction actor startswith="Starting" endswith="Finished"

topic Reporting on multiple transactions in Splunk Search

Reporting on multiple transactions

Re: Reporting on multiple transactions