topic Re: Transaction Duration Duplicated due to multiple same event in Splunk Search

Transaction Duration Duplicated due to multiple same event

YoussefB — Mon, 28 Sep 2020 15:22:09 GMT

Hello,

I'm trying to get the duration of a transaction starting with "green" and stopping with "red" :
The problem is that when i have data like this :

time_001 Green
time_002 Green
time_003 Red
time_004 Red
time_005 Green
time_006 Red
time_007 Green
time_008 Green
time_009 Red

The calculated duration is ko because of the duplicated events.
This is my search query :
host="Data_Host" "Connected"
| rex ="Host (?.) - (?.)"
| transaction host startswith="*Green" endswith="Red"
| stats sum(duration) as "uptime_duration" by ligneNum
| convert timeformat="%d/%m/%y-%H:%M:%S" ctime(_time) AS "uptime_duration"
| fieldformat uptime_duration=tostring(uptime_duration,"duration")

I want my transactions to ignore the same redondant successif colors.
the result should be something like :
- time_001 Green
- time_003 Red
- time_005 Green
- time_006 Red
- time_007 Green
- time_009 Red

Re: Transaction Duration Duplicated due to multiple same event

ahrefai — Tue, 26 Nov 2013 14:34:36 GMT

try dedup; a filtering command for removing redundunt data that match specific criteria

Re: Transaction Duration Duplicated due to multiple same event

YoussefB — Tue, 26 Nov 2013 14:53:25 GMT

Hello,

I already tested : dedup color
But the result is not what i expected.
can you give more informations about dedup filters ?

Re: Transaction Duration Duplicated due to multiple same event

davebrooking — Mon, 28 Sep 2020 15:22:16 GMT

I doubt if this is the most elegant way, it may not even be a correct way (reading the documentation dedup should keep the most recent event) but using reverse prior to the dedup seems to keep the events you want (if time_001 is earlier than time_002).

Dave