https://community.splunk.com/t5/Splunk-Search/How-to-find-the-duration-of-overlapping-transactions/m-p/328404#M97770 <P>Will you always have only two events to match up?</P> <P>If you will have more than two, will you have them already correlated (like with a <CODE>transaction</CODE> command)?</P> Mon, 11 Sep 2017 21:39:04 GMT cpetterborg 2017-09-11T21:39:04Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-duration-of-overlapping-transactions/m-p/328403#M97769 <P>Ok, </P> <P>I have two or more transactions like this:</P> <P>Host:abc123_01 start:08:00 end:10:00<BR /> Host:abc123_02 start:09:05 end:11:00</P> <P>If you look the time windows of the transactions overlap. I would like to be able to calculate the duration of the overlap itself.</P> <P>Not sure if there is an automated way.</P> <P>Any help would be appreciated,<BR /> Rcp </P> Tue, 29 Sep 2020 15:41:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-duration-of-overlapping-transactions/m-p/328403#M97769 raynold_peterso 2020-09-29T15:41:54Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-duration-of-overlapping-transactions/m-p/328404#M97770 <P>Will you always have only two events to match up?</P> <P>If you will have more than two, will you have them already correlated (like with a <CODE>transaction</CODE> command)?</P> Mon, 11 Sep 2017 21:39:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-duration-of-overlapping-transactions/m-p/328404#M97770 cpetterborg 2017-09-11T21:39:04Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-duration-of-overlapping-transactions/m-p/328405#M97771 <P>Adapt one of these - </P> <P><A href="https://answers.splunk.com/answers/513002/how-to-graph-sum-of-overlapping-values-given-start.html#answer-514225">https://answers.splunk.com/answers/513002/how-to-graph-sum-of-overlapping-values-given-start.html#answer-514225</A><BR /> <A href="https://answers.splunk.com/answers/565112/suggestions-for-charting-backlogs-by-month.html">https://answers.splunk.com/answers/565112/suggestions-for-charting-backlogs-by-month.html</A></P> <P>The basic idea is to break each transaction into two - one that +1s the count at the start, and one that -1s the count at the end. In your use case, any increment of time where the total open count is 2 or more is a unit of overlap. </P> Mon, 11 Sep 2017 23:06:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-duration-of-overlapping-transactions/m-p/328405#M97771 DalJeanis 2017-09-11T23:06:17Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-duration-of-overlapping-transactions/m-p/328406#M97772 <P>You can do some crazy stuff with <CODE>concurrency</CODE>:<BR /> <A href="https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Concurrency">https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Concurrency</A></P> <P>Search for <CODE>woodcock splunk answers concurrency</CODE> and maybe something that I have written before will get you going.</P> Tue, 12 Sep 2017 05:15:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-duration-of-overlapping-transactions/m-p/328406#M97772 woodcock 2017-09-12T05:15:28Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-duration-of-overlapping-transactions/m-p/328407#M97773 <P>Hey @raynold.peterson, don't forget to accept an answer if one of these solutions worked for you. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> Everyone loves karma points! Happy Splunking!</P> Wed, 13 Sep 2017 00:42:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-duration-of-overlapping-transactions/m-p/328407#M97773 lfedak_splunk 2017-09-13T00:42:55Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-duration-of-overlapping-transactions/m-p/328408#M97774 <P>Especially this one:<BR /> <A href="https://answers.splunk.com/answers/319585/how-to-graph-the-number-of-active-sessions-over-ti.html?childToView=318699#answer-318699">https://answers.splunk.com/answers/319585/how-to-graph-the-number-of-active-sessions-over-ti.html?childToView=318699#answer-318699</A></P> Wed, 15 Nov 2017 18:32:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-duration-of-overlapping-transactions/m-p/328408#M97774 woodcock 2017-11-15T18:32:44Z