topic Transaction by source, sourcetype, day in Splunk Search

Transaction by source, sourcetype, day

sanjay_shrestha — Thu, 12 Dec 2013 15:45:12 GMT

Following query has been used to calculate duration for individual source (input files) for last 5 days:

index="my_index" earliest=-5d  latest=now| transaction source maxevents=-1 | eval day=strftime(_time,"%m/%d/%Y")| sort - day sourcetype| table day,sourcetype,source,duration

Only transaction by source is used, hoping it would capture all the input files which have unique file name, thus separating its sourcetype and date.

Basically, just need to display duration per individual source file per sourcetype per day.

Thanks,

Sanjay

Re: Transaction by source, sourcetype, day

aholzer — Mon, 28 Sep 2020 15:28:20 GMT

Because you have no limit to the number of events in your transaction, and because you have no start and end points for your transactions, and furthermore you have nothing limiting the transactions other than "source", then you are going to get 1 event (transaction) per source value you have.

You should calculate the day first, then use the day together with the source in your transaction. Like so:
index="my_index" earliest=-5d latest=now | eval day=strftime(_time,"%m/%d/%Y") | transaction source day maxevents=-1 | sort - day sourcetype| table day,sourcetype,source,duration

Re: Transaction by source, sourcetype, day

aholzer — Thu, 12 Dec 2013 16:25:09 GMT

Now the above simply answers your question. I'm sure that there is a more efficient way of going about doing what you need, but I currently don't have time to work on it 😛

Hope the above helps.

Re: Transaction by source, sourcetype, day

sanjay_shrestha — Thu, 12 Dec 2013 16:54:28 GMT

It worked by adding keepevicted=true to transaction command.

Re: Transaction by source, sourcetype, day

lguinn2 — Thu, 12 Dec 2013 16:57:21 GMT

There is a much more efficient way to do this:

index="my_index" earliest=-5d  latest=now
| eval day=strftime(_time,"%m/%d/%Y")
| stats range(_time) as duration by day sourcetype source
| eval duration=tostring(duration,"duration")

This is faster and more scalable.

Re: Transaction by source, sourcetype, day

sanjay_shrestha — Thu, 12 Dec 2013 17:23:11 GMT

Thanks. It worked better that using transaction.