topic Start timer with transaction in Splunk Search

Start timer with transaction

Abarny — Thu, 13 Apr 2017 09:05:11 GMT

Hi guys,

I need help cause I want start a timer when i have one values and end this same timer when this values is different.

I would use the function Transaction but i think it's not the better solution.

Exemple: When the weither have the value 2 i start the timer and when the weither take after the values 1 i stop the timer.

index="xxx" 
|fields logs{}.projectId,logs{}.newWeatherId
|transaction logs{}.projectId startswith=eval(logs{}.newWeatherId="2") endswith=eval(logs{}.newWeatherId!=2) keepevicted

Thanks for your answers.

Re: Start timer with transaction

niketn — Thu, 13 Apr 2017 10:03:40 GMT

transaction creates a default field called duration which captures what you are intending. Just pipe

| table logs{}.projectID eventcount duration

However, better way would be to go for stats command to handle such scenarios which will perform better.

Re: Start timer with transaction

cmerriman — Tue, 29 Sep 2020 13:39:09 GMT

you could try using the maxspan and maxpause options in transaction but i'm not sure that's really what you're going for.

If you're using v6.5, try using streamstats.
http://docs.splunk.com/Documentation/Splunk/6.5.3/SearchReference/Streamstats
The reset_on_change command might be what you need.