hi i used the below query..
--|transaction Taskaction startswith=START endswith=Succeeded|table Taskaction duration
i got the duration for each and every task..as
TaskAction duration
task1 12
task2 4.2
task3 13
task4 76
if i want to filter task1 and its duration..how to do that
plz help
Are you asking about how to use the search
command?
... | transaction Taskaction startswith=START endswith=Succeeded|table Taskaction duration | search TaskAction=task1
Also, if this is what you were after, may I suggest that you take the Splunk introduction tutorial.
Are you asking about how to use the search
command?
... | transaction Taskaction startswith=START endswith=Succeeded|table Taskaction duration | search TaskAction=task1
Also, if this is what you were after, may I suggest that you take the Splunk introduction tutorial.