https://community.splunk.com/t5/Splunk-Search/How-to-calculate-time-elapsed-for-concurrent-transactions-across/m-p/195011#M56250 <P>Unless I'm missing something, this doesn't appear to be giving me anything different in the results.</P> Tue, 26 Aug 2014 14:06:57 GMT chriscje 2014-08-26T14:06:57Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-time-elapsed-for-concurrent-transactions-across/m-p/195009#M56248 <P>I've been looking around the forums, but nothing seems to quite cover what I need.</P> <P>We are currently logging stats for a conference solution, which logs start and stops times. These can be grouped as transactions, and obviously I can sum the duration. The problem is that as this is a distributed conference solution, the same conference runs on multiple nodes/servers, but the transactions only relate to a single node/server. This means I could have two transactions for the same conference, (active on different nodes/servers).</P> <P>In short, we need to know how long a conference is active over a given period (say 30 days) regardless of how many nodes/servers it is active on at any point.</P> <P>My search to return transactions (grouped by node and conference) is below, I just can't see how to get the active time span:</P> <P>index=vmr Name=administrator.conference Message="Conference has been created." OR Message="Conference has been stopped." | transaction Conference host startswith="Conference has been created." endswith="Conference has been stopped."</P> Tue, 26 Aug 2014 09:49:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-time-elapsed-for-concurrent-transactions-across/m-p/195009#M56248 chriscje 2014-08-26T09:49:53Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-time-elapsed-for-concurrent-transactions-across/m-p/195010#M56249 <P>How about this?</P> <PRE><CODE>index=vmr Name=administrator.conference Message="Conference has been created." OR Message="Conference has been stopped." | transaction Conference host startswith="Conference has been created." endswith="Conference has been stopped." | sort 0 Conference _time | eventstats sum(duration) as ActiveSpan by Conference | table _time Conference host duration ActiveSpan </CODE></PRE> Tue, 26 Aug 2014 12:52:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-time-elapsed-for-concurrent-transactions-across/m-p/195010#M56249 somesoni2 2014-08-26T12:52:58Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-time-elapsed-for-concurrent-transactions-across/m-p/195011#M56250 <P>Unless I'm missing something, this doesn't appear to be giving me anything different in the results.</P> Tue, 26 Aug 2014 14:06:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-time-elapsed-for-concurrent-transactions-across/m-p/195011#M56250 chriscje 2014-08-26T14:06:57Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-time-elapsed-for-concurrent-transactions-across/m-p/195012#M56251 <P>You should have a field call ActiveSpan available in the fieldPicker on the left. Or try the updated answer with a table command</P> Tue, 26 Aug 2014 16:01:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-time-elapsed-for-concurrent-transactions-across/m-p/195012#M56251 somesoni2 2014-08-26T16:01:36Z